92 free Microsoft MS-102 practice questions from the CertStash pack of 460, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 92 free here, all 460 in the pack, and each step includes the one before it.
Get all 460 questions (US$39) · Download the first 10 as a PDF
Question 1
Your company has a Microsoft 365 subscription. You need to identify all the users in the subscription who are licensed for Office 365 through a group membership. The solution must include the name of the group used to assign the license. What should you use?
Show answer and explanation
Correct answer: C. the Licenses blade in the Microsoft Entra admin center
The Licenses blade in the Microsoft Entra admin center provides a view of all users licensed through group membership and displays which specific group is assigned to each license. This is the dedicated tool for identifying users with group-based licensing and their associated groups.
Why the other options are wrong
- A. Active users in the Microsoft 365 admin center shows user licensing status but does not specifically identify group-based licensing or the group names used.
- B. Reports in Microsoft Purview compliance portal focus on compliance and security matters, not licensing information.
- D. Reports in the Microsoft 365 admin center provide general license usage but lack the specific group membership details shown in the Licenses blade.
Question 2
Your network contains an Active Directory forest named contoso.local. You purchase a Microsoft 365 subscription. You plan to move to Microsoft 365 and to implement a hybrid deployment solution for the next 12 months. You need to prepare for the planned move to Microsoft 365. What is the best action to perform before you implement directory synchronization? More than one answer choice may achieve the goal. Select the BEST answer.
Show answer and explanation
Correct answer: D. Purchase a custom domain name.
Purchasing a custom domain name is the best preparatory action before implementing directory synchronization. Microsoft 365 requires a routable domain, and having this in place ensures proper UPN formatting and mail flow configuration. While on-premises forest is contoso.local, the Microsoft 365 tenant will use a public domain like contoso.com.
Why the other options are wrong
- A. X.509 certificates are used for specific scenarios like certificate-based authentication but are not required before directory synchronization.
- B. External forest trusts are not necessary for hybrid Microsoft 365 deployments using directory synchronization.
- C. Renaming the Active Directory forest is not required or recommended before implementing hybrid Microsoft 365 solutions.
Question 3
You have a Microsoft 365 subscription. You configure a new Azure AD enterprise application named App1. App1 requires that a user be assigned the Reports Reader role. Which type of group should you use to assign the Reports Reader role and to access App1?
Show answer and explanation
Correct answer: C. a security group that has assigned membership
A security group with assigned membership is the correct choice for assigning roles to an Azure AD enterprise application. Security groups can be assigned roles in Azure AD applications, whereas Microsoft 365 groups are primarily for collaboration and mailbox scenarios. Assigned membership provides explicit control over role assignments.
Why the other options are wrong
- A. Microsoft 365 groups are designed for collaboration and team scenarios, not for role assignment to enterprise applications.
- B. Microsoft 365 groups with dynamic membership are also not the appropriate group type for assigning application roles.
- D. While security groups are correct, dynamic membership is less appropriate than assigned membership when you need explicit control over which users have specific application roles.
Question 4
You have a new Microsoft 365 E5 tenant. You need to enable an alert policy that will be triggered when an elevation of Microsoft Exchange Online administrative privileges is detected. What should you do first?
Show answer and explanation
Correct answer: A. Enable auditing.
Auditing must be enabled first before alert policies can function in Microsoft 365. Alert policies rely on the audit log to detect and trigger on specific activities such as elevation of Exchange Online administrative privileges. Without auditing enabled, the system cannot capture the events needed to trigger alerts.
Why the other options are wrong
- B. Microsoft 365 usage analytics are not prerequisites for creating alert policies.
- C. Insider risk management policies are a separate compliance feature and are not required before enabling basic alert policies.
- D. Communication compliance policies are distinct from alert policies and are not necessary prerequisites for privilege elevation alerts.
Question 5
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices. You perform a proof of concept (PoC) deployment of Microsoft Defender for Endpoint for 10 test devices. During the onboarding process, you configure Microsoft Defender for Endpoint-related data to be stored in the United States. You plan to onboard all the devices to Microsoft Defender for Endpoint. You need to store the Microsoft Defender for Endpoint data in Europe. What should you do first?
Show answer and explanation
Correct answer: D. Offboard the test devices.
The data residency setting in Microsoft Defender for Endpoint cannot be changed after initial onboarding. Therefore, the test devices must first be offboarded to reset the data location configuration. After offboarding, a new workspace can be created with the Europe data residency setting, and all devices can be re-onboarded with the correct configuration.
Why the other options are wrong
- A. Deleting the workspace does not change the data residency setting; it only removes the workspace without allowing reconfiguration.
- B. Creating a workspace does not address the data residency issue since the current workspace is already configured for US storage.
- C. Onboarding a new device would still associate it with the existing US-based workspace, not changing the data location.
Question 6
You have a Microsoft 365 E5 subscription that contains a user named User1. User1 exceeds the default daily limit of allowed email messages and is on the Restricted entities list. You need to remove User1 from the Restricted entities list. What should you use?
Show answer and explanation
Correct answer: D. the Microsoft 365 Defender portal
The Microsoft 365 Defender portal is the correct tool for managing the Restricted entities list. When a user exceeds email sending limits, they are added to this list, and removal requires access to Defender's threat management capabilities, specifically the Restricted entities section under Mail flow.
Why the other options are wrong
- A. The Exchange admin center manages mailbox and mail flow policies but not the Restricted entities list
- B. Microsoft Purview compliance portal handles data governance and compliance, not entity restrictions
- C. The Microsoft 365 admin center manages general tenant settings and user management, not security restrictions
- E. The Microsoft Entra admin center manages identity and access, not mail security restrictions
Question 7
Your company has a Microsoft 365 E5 subscription. Users in the research department work with sensitive data. You need to prevent the research department users from accessing potentially unsafe websites by using hyperlinks embedded in email messages and documents. Users in other departments must not be restricted. What should you do?
Show answer and explanation
Correct answer: D. Create a new safe links policy.
Creating a new Safe Links policy allows you to apply Safe Links protection specifically to the research department users while excluding other departments. Safe Links policies can be scoped to specific user groups and protect against unsafe URLs in emails and documents.
Why the other options are wrong
- A. DLP policies with Content is shared condition focus on data sharing, not URL protection
- B. Modifying Global settings would apply Safe Links to all users, not just the research department
- C. DLP policies with Content contains condition scan for sensitive data patterns, not URL safety
Question 8
You have a Microsoft 365 E5 subscription. You need to compare the current Safe Links configuration to the Microsoft recommended configurations. What should you use?
Show answer and explanation
Correct answer: D. the configuration analyzer
The configuration analyzer is the dedicated tool in Microsoft Defender for Office 365 that compares your current Safe Links configuration against Microsoft's recommended security baselines and best practices.
Why the other options are wrong
- A. Microsoft Purview focuses on data governance and compliance, not security configuration comparison
- B. Azure AD Identity Protection manages identity risk, not Office 365 configuration recommendations
- C. While Secure Score provides security posture guidance, the configuration analyzer is the specific tool for Safe Links comparison
Question 9
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You need to ensure that users are prevented from opening or downloading malicious files from Microsoft Teams, OneDrive, or SharePoint Online. What should you do?
Show answer and explanation
Correct answer: D. Configure the Safe Attachments global settings.
Safe Attachments global settings enable protection against malicious files in Teams, OneDrive, and SharePoint Online by scanning attachments and preventing users from opening or downloading detected malware.
Why the other options are wrong
- A. Anti-malware policies protect email messages, not cloud app integrations
- B. Safe Links global settings protect against malicious URLs, not file downloads
- C. Anti-phishing policies protect against phishing attacks, not malware file downloads
Question 10
You have a Microsoft 365 tenant. You plan to manage incidents in the tenant by using the Microsoft 365 Defender. Which Microsoft service source will appear on the Incidents page of the Microsoft 365 Defender portal?
Show answer and explanation
Correct answer: D. Microsoft Defender for Identity
Microsoft Defender for Identity is a native Microsoft 365 Defender component that appears on the Incidents page, providing identity-based threat detection and incident reporting integrated into the Defender portal.
Why the other options are wrong
- A. Microsoft Sentinel is a separate SIEM service that connects to Defender but is not a source service within Defender itself
- B. Microsoft Defender for Cloud is an Azure-focused service and does not appear as a source in Microsoft 365 Defender incidents
- C. Azure Arc is an infrastructure management service, not a security source for Defender incidents
What people say about the full MS-102 pack 4.7 from 7
I have used MS-102 for your website and I am pretty impressed by the content you guys are providing at such an average cost. I will surely come again for another certification preparation!
Question 11
Your company has three main offices and one branch office. The branch office is used for research. The company plans to implement a Microsoft 365 tenant and to deploy multi-factor authentication. You need to recommend a Microsoft 365 solution to ensure that multi-factor authentication is enforced only for users in the branch office. What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure AD conditional access
Azure AD Conditional Access allows you to create policies that enforce multi-factor authentication based on specific conditions, such as user location or group membership. This is the appropriate tool to enforce MFA selectively for users in the branch office while exempting users in the three main offices. Conditional Access provides granular control over authentication requirements based on risk, location, device, and other signals.
Why the other options are wrong
- A. Azure AD password protection protects against weak passwords and compromised credentials, not controlling MFA enforcement based on location.
- B. Intune device configuration profiles manage device settings but do not enforce MFA requirements at the sign-in level.
- C. Intune device compliance policies evaluate device compliance status but are not the primary mechanism for enforcing MFA based on user location.
Question 12
You have a Microsoft 365 E5 subscription that is linked to an Azure AD tenant named contoso.com. You purchase 100 Microsoft 365 Business Voice add-on licenses. You need to ensure that the members of a group named Voice are assigned a Microsoft 365 Business Voice add-on license automatically. What should you do?
Show answer and explanation
Correct answer: C. From the Microsoft 365 admin center, modify the settings of the Voice group.
From the Microsoft 365 admin center, you can modify group settings to enable group-based licensing, which automatically assigns Microsoft 365 Business Voice add-on licenses to all members of the Voice group. This is the appropriate location for managing license assignments to groups in Microsoft 365.
Why the other options are wrong
- A. The Licenses page of the Microsoft 365 admin center is for managing individual license assignments, not for configuring automatic group-based licensing.
- B. While Microsoft Entra is used for group management, license assignment through groups is configured in the Microsoft 365 admin center, not through Entra group settings.
Question 13
You have a Microsoft 365 subscription. You register two applications named App1 and App2 to Azure AD. You need to ensure that users who connect to App1 require multi-factor authentication (MFA). MFA is required only for App1. What should you do?
Show answer and explanation
Correct answer: A. From the Microsoft Entra admin center, create a conditional access policy.
Creating a Conditional Access policy from the Microsoft Entra admin center allows you to target a specific application (App1) and require MFA only for that app, while leaving App2 and other applications without the MFA requirement.
Why the other options are wrong
- B. The Modern authentication settings in Microsoft 365 admin center apply to the entire tenant, not individual applications
- C. Configuring Users settings in Enterprise applications manages user assignments but not MFA requirements
- D. Multi-Factor Authentication service settings apply globally, not to specific applications
Question 14
You have a Microsoft 365 E5 tenant. Users store data in the following locations: • Microsoft Teams • Microsoft OneDrive • Microsoft Exchange Online • Microsoft SharePoint You need to retain Microsoft 365 data for two years. What is the minimum number of retention policies that you should create?
Show answer and explanation
Correct answer: C. 3
A single retention policy can apply to multiple locations (Teams, OneDrive, Exchange, SharePoint), but the different workload types often require separate policy configurations due to their distinct content types and retention requirements. While theoretically one policy could target all locations, best practice and the exam expectation is to create separate policies for Teams (including Teams chats and channels), OneDrive, Exchange Online, and SharePoint, requiring a minimum of 3 policies for proper management of the four location types.
Why the other options are wrong
- A. A single retention policy cannot efficiently manage all four distinct Microsoft 365 workload types with their different content structures.
- B. Two policies would not adequately separate the four distinct location types with their unique retention requirements.
- D. Four separate policies for four locations is possible but exceeds the minimum requirement needed for proper configuration.
Question 15
Your company has a Microsoft 365 E5 subscription. You onboard a device on the company's network to Microsoft Defender for Endpoint. In the Microsoft 365 Defender portal, you notice that the device inventory displays many devices that have an Onboarding status of Can be onboarded. You need to ensure that onboarded devices are prevented from polling the network for device discovery but can still discover devices with which they communicate directly. What should you configure in the Microsoft 365 Defender portal?
Show answer and explanation
Correct answer: C. basic discovery
Basic discovery mode is the configuration that prevents onboarded devices from polling the network for device discovery while still allowing them to discover devices with which they communicate directly. This mode limits discovery to direct communications rather than active network scanning.
Why the other options are wrong
- A. Standard discovery actively polls the network for device discovery, which is the opposite of the requirement.
- B. Device discovery exclusions are used to exclude specific devices but do not control the discovery mode behavior.
- D. A network assessment job is used for vulnerability assessment, not for controlling device discovery behavior.
Question 16
You have a Microsoft 365 subscription. You suspect that several Microsoft Office 365 applications or services were recently updated. You need to identify which applications or services were recently updated. What are two possible ways to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, D. From the Microsoft 365 admin center, review the Message center blade; From the Microsoft 365 Admin mobile app, review the messages.
Both the Message center blade in the Microsoft 365 admin center and the Microsoft 365 Admin mobile app are the primary locations for communicating updates, changes, and planned maintenance for Microsoft 365 services. The Message center specifically notifies administrators about service updates and changes before they roll out. The Service health blade shows current service status, not update announcements, and the Products blade shows subscription information rather than update notifications.
Why the other options are wrong
- A. The Service health blade displays current service status and incidents, not notifications about which services were recently updated.
- C. The Products blade shows information about your subscription products, not update announcements or service changes.
Question 17
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint site named site1. You need to ensure that site1 meets the following requirements: • Retains all data for 10 years • Prevents the sharing of data outside the organization Which two items should you create and apply to site1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, B. a retention policy; a data loss prevention (DLP) policy
A retention policy ensures data is retained for 10 years, and a DLP policy prevents sharing of data outside the organization. The retention policy handles the retention requirement at the site level, while the DLP policy enforces the external sharing restriction. Together, these two tools address both compliance requirements for the SharePoint site.
Why the other options are wrong
- C. Retention label policies apply labels to items but work best when paired with sensitivity labels; retention policy is simpler for site-wide retention.
- D. Sensitive info types are used within DLP policies to identify content but are not applied directly to sites.
- E. Retention labels require manual or automatic application to individual items, not an efficient solution for site-wide 10-year retention.
- F. Sensitivity labels control access and permissions but do not provide the retention duration requirement or prevent external sharing as effectively as DLP.
Question 18
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription. You create an account for a new security administrator named SecAdmin1. You need to ensure that SecAdmin1 can manage Microsoft Defender for Office 365 settings and policies for Microsoft Teams, SharePoint, and OneDrive. Solution: From the Microsoft Entra admin center, you assign SecAdmin1 the Security Administrator role. Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
The Security Administrator role in Microsoft Entra (Azure AD) has the appropriate permissions to manage Microsoft Defender for Office 365 settings and policies across Microsoft Teams, SharePoint, and OneDrive. This role provides the necessary permissions for security-related management tasks across all these services.
Why the other options are wrong
- B. The Security Administrator role explicitly includes permissions for managing Defender for Office 365 across all Microsoft 365 workloads including Teams, SharePoint, and OneDrive.
Question 19
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory forest. You deploy Microsoft 365. You plan to implement directory synchronization. You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements: • Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. • User passwords must be 10 characters or more. Solution: Implement pass-through authentication and modify the password settings from the Default Domain Policy in Active Directory. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Pass-through authentication requires Active Directory to be available for user authentication, it does not allow users to authenticate to Microsoft 365 if AD becomes unavailable. This directly violates the first requirement. While modifying password settings in Default Domain Policy addresses the 10-character requirement, the authentication method chosen fails the primary availability requirement.
Why the other options are wrong
- A. The solution does not meet the goals because pass-through authentication requires AD availability for all authentications.
Question 20
You have a Microsoft 365 E5 tenant. You configure sensitivity labels. Users report that the Sensitivity button is unavailable in Microsoft Word for the web. The Sensitivity button is available in Microsoft 365 Word. You need to ensure that the users can apply the sensitivity labels when they use Word for the web. What should you do?
Show answer and explanation
Correct answer: A. Enable sensitivity labels for files in Microsoft SharePoint and OneDrive.
For sensitivity labels to be available in Microsoft Word for the web and other Office web applications, you must explicitly enable sensitivity labels for files in Microsoft SharePoint and OneDrive. This setting activates the labeling UI in the web versions of Office applications, allowing users to apply sensitivity labels when working in browsers.
Why the other options are wrong
- B. Publishing sensitivity labels makes them available to users but does not enable the button in web applications without the SharePoint/OneDrive setting.
- C. Azure Information Protection policies are legacy; modern sensitivity labels do not require copying from AIP.
- D. Auto-labeling policies automatically apply labels but do not enable the manual Sensitivity button in web applications.
Question 21
You have a Microsoft 365 subscription that uses retention policies. You implement a preservation lock on a retention policy that is assigned to all executive users. Which two actions can you perform on the retention policy after you implemented the preservation lock? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. Add locations to the policy; Extend the duration of the policy.
When a preservation lock is applied to a retention policy, it prevents reduction of retention duration and prevents policy deletion or disabling, but allows extending retention duration and adding new locations. You can extend the duration to make it longer (increasing protection) and add locations to expand policy scope. Options B, C, and E (reducing duration, removing locations, and disabling) are all prohibited by preservation lock.
Why the other options are wrong
- B. Reducing the duration is prohibited by a preservation lock once applied.
- C. Removing locations from the policy is prohibited by a preservation lock once applied.
- E. Disabling the policy is prohibited by a preservation lock once applied.
Question 22
Your network contains an on-premises Active Directory domain named contoso.local. The domain contains five domain controllers. Your company purchases Microsoft 365 and creates an Azure AD tenant named contoso.onmicrosoft.com. You plan to install Azure AD Connect on a member server and implement pass-through authentication. You need to prepare the environment for the planned implementation of pass-through authentication. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, E, F. From Active Directory Domains and Trusts, add a UPN suffix; From the Microsoft Entra admin center, add a custom domain name; Modify the User logon name for each user account.
The on-premises domain uses the non-routable suffix contoso.local, which cannot be used to sign in to Microsoft 365. You must add and verify a routable custom domain in Microsoft Entra, add the matching UPN suffix in Active Directory Domains and Trusts, and change each user's logon name to use the new suffix. Azure AD Connect installs the first authentication agent and enables pass-through authentication during setup.
Why the other options are wrong
- A. Azure AD Connect installs the first authentication agent itself, so this is not a preparation step.
- B. Pass-through authentication is selected and enabled in the Azure AD Connect wizard, not prepared in the Entra admin center.
- D. The email address attribute is not used for sign-in, so changing it does not fix the non-routable UPN.
Question 23
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory forest. You deploy Microsoft 365. You plan to implement directory synchronization. You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements: • Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. • User passwords must be 10 characters or more. Solution: Implement password hash synchronization and modify the password settings from the Default Domain Policy in Active Directory. Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
Password hash synchronization allows users to authenticate to Microsoft 365 even when on-premises Active Directory is unavailable, meeting the first requirement. Modifying the Default Domain Policy in Active Directory to enforce a 10-character minimum password length meets the second requirement. This combination satisfies both stated requirements for the directory synchronization security solution.
Why the other options are wrong
- B. This solution actually meets both requirements: password hash sync ensures availability and AD password policy enforces length requirements.
Question 24
You have a Microsoft 365 subscription. You need to configure a compliance solution that meets the following requirements: Defines sensitive data based on existing data samples Automatically prevents data that matches the samples from being shared externally in Microsoft SharePoint or email messages Which two components should you configure? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, E. a trainable classifier; a data loss prevention (DLP) policy
A trainable classifier learns from data samples to identify sensitive data patterns, allowing custom detection of organization-specific sensitive information. A Data Loss Prevention (DLP) policy then uses this classifier to automatically prevent the identified data from being shared externally via SharePoint or email. Together, these two components create a complete solution that defines sensitive data based on samples and enforces prevention of external sharing.
Why the other options are wrong
- B. Sensitive info types are predefined patterns for known data types, not custom classifiers based on data samples.
- C. Insider risk policies monitor user behavior and risky activities, not prevent external data sharing.
- D. Adaptive policy scopes define where policies apply based on user properties, not identify or prevent sensitive data sharing.
Question 25
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory forest. You deploy Microsoft 365. You plan to implement directory synchronization. You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements: • Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. • User passwords must be 10 characters or more. Solution: Implement pass-through authentication and configure password protection in the Azure AD tenant. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Pass-through authentication requires Active Directory connectivity for authentication, so it fails the requirement that users must authenticate if AD becomes unavailable. Additionally, Azure AD password protection does not enforce minimum password length requirements. The solution fails on both the availability requirement and the password length enforcement requirement.
Why the other options are wrong
- A. Pass-through authentication cannot meet the requirement for authentication when AD is unavailable, and password protection does not enforce character length minimums.
Question 26
You have a Microsoft 365 E5 subscription. The subscription contains users that have the following types of devices: • Windows 10 • Android • iOS On which devices can you configure the Endpoint DLP policies?
Show answer and explanation
Correct answer: A. Windows 10 only
Endpoint Data Loss Prevention (Endpoint DLP) policies in Microsoft 365 are currently supported and configurable only on Windows 10 devices. Support for Android and iOS devices is not available for Endpoint DLP policies, though these platforms may be supported by other data protection mechanisms like app-based protection.
Why the other options are wrong
- B. Android devices are not supported for Endpoint DLP policy configuration.
- C. iOS devices are not supported for Endpoint DLP policy configuration.
- D. Both Android and iOS are not supported for Endpoint DLP policies.
Question 27
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. A Built-in protection preset security policy is applied to the subscription. Which two policy types will be applied by the Built-in protection policy? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. Safe Attachments; Safe Links
The Built-in protection preset security policy in Microsoft Defender for Office 365 applies Safe Attachments and Safe Links policies by default. These two policy types provide baseline protection without requiring manual configuration. Anti-malware, anti-phishing, and anti-spam are handled through separate default policies, not the Built-in protection preset.
Why the other options are wrong
- A. Anti-malware protection is provided through default policies, not the Built-in protection preset.
- D. Anti-phishing is configured separately from the Built-in protection preset.
- E. Anti-spam is configured separately from the Built-in protection preset.
Question 28
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory forest. You deploy Microsoft 365. You plan to implement directory synchronization. You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements: • Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. • User passwords must be 10 characters or more. Solution: Implement password hash synchronization and configure password protection in the Azure AD tenant. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
While password hash synchronization meets the first requirement (allowing authentication when AD is unavailable), password protection in Azure AD does not enforce minimum password length requirements like '10 characters or more'. Azure AD password protection is designed for banning custom words and weak passwords, not for setting character length minimums. A different mechanism is needed for the length requirement.
Why the other options are wrong
- A. Password protection in Azure AD cannot enforce minimum password length requirements of 10 characters.
Question 29
You have a Microsoft 365 subscription. You plan to implement Microsoft Purview Privileged Access Management. Which Microsoft Office 365 workloads support privileged access?
Show answer and explanation
Correct answer: A. Microsoft Exchange Online only
Microsoft Purview Privileged Access Management currently supports Microsoft Exchange Online as the primary workload. While there are roadmap plans for expansion to other workloads like SharePoint Online and Teams, as of current implementations, Exchange Online is the confirmed supported workload for PAM functionality.
Why the other options are wrong
- B. Microsoft Teams is not currently a supported workload for Privileged Access Management.
- C. While Exchange Online is supported, SharePoint Online is not currently a supported workload for PAM.
- D. Neither Teams nor SharePoint Online are currently supported workloads for Privileged Access Management.
- E. Although Exchange Online is supported, Teams and SharePoint Online are not currently supported by Privileged Access Management.
Question 30
You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint. From Microsoft 365 Defender portal, you perform a security investigation. You need to run a PowerShell script on the device to collect forensic information. Which action should you select on the device page?
Show answer and explanation
Correct answer: C. Initiate Live Response Session
Initiate Live Response Session is the action that allows running custom PowerShell scripts on a device for forensic investigation and data collection. Live Response provides an interactive session to execute commands and scripts directly on the endpoint, making it the appropriate choice for collecting forensic information via PowerShell.
Why the other options are wrong
- A. Collect investigation package gathers predefined diagnostic data but does not allow running custom PowerShell scripts.
- B. Go hunt is for advanced hunting queries in the portal, not for running scripts on individual devices.
- D. Initiate Automated Investigation runs Microsoft's automated investigation and response capabilities, not custom user-defined scripts.
Question 31
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You notice that it takes several days to notify email recipients when an incoming email message is marked as spam, and then quarantined. You need to ensure that the email recipients are notified within 24 hours. What should you do?
Show answer and explanation
Correct answer: D. Modify the global settings for quarantine policies.
Quarantine notification timing is controlled through global quarantine policy settings, not individual anti-spam policies or specific quarantine policy templates. Modifying the global settings for quarantine policies allows you to configure the end-user spam notification frequency to ensure recipients are notified within 24 hours rather than several days.
Why the other options are wrong
- A. Anti-spam policies define what gets quarantined but not notification timing.
- B. DefaultFullAccessPolicy is a template for access levels, not notification schedules.
- C. Custom quarantine policies still inherit timing from global settings unless global settings are adjusted first.
Question 32
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You plan to perform device discovery and authenticated scans of network devices. You install and register the network scanner on a device named Device1. What should you do next?
Show answer and explanation
Correct answer: C. Create an assessment job.
After installing and registering the network scanner on Device1, the next step is to create an assessment job. This job defines what devices will be scanned, the scan parameters, and schedule. Assessment jobs are the mechanism through which authenticated scans are configured and executed in Microsoft Defender for Endpoint's device discovery feature.
Why the other options are wrong
- A. Connecting to Intune is not required for network scanner setup and would be a separate integration task.
- B. Microsoft Threat Experts notifications are optional services unrelated to initial scanner configuration.
- D. The onboarding package is for onboarding endpoints to Defender, not for configuring the network scanner.
Question 33
You have a Microsoft 365 E5 subscription that contains the following user: • Name: User1 • UPN: user1@contoso.com • Email address: user1@marketmg.contoso.com • MFA enrollment status: Disabled When User1 attempts to sign in to Outlook on the web by using the user1@marketing.contoso.com email address, the user cannot sign in. You need to ensure that User1 can sign in to Outlook on the web by using user1@marketing.contoso.com. What should you do?
Show answer and explanation
Correct answer: D. Modify the UPN of User1.
User1's UPN is user1@contoso.com, but the email address (proxy address) is user1@marketing.contoso.com. When attempting to sign in with user1@marketing.contoso.com, Azure AD cannot authenticate because the UPN does not match. Modifying the UPN to match the sign-in email address (user1@marketing.contoso.com) ensures that authentication succeeds when the user signs in with that email.
Why the other options are wrong
- A. MFA enrollment status is disabled and is unrelated to sign-in authentication failures based on email address mismatch.
- B. Resetting the password does not resolve the fundamental issue that the UPN does not match the email address used for sign-in.
- C. Adding an alternate email address (proxy address) does not change the UPN; sign-in authentication in Azure AD is based on UPN, not proxy addresses.
Question 34
Your on-premises network contains an Active Directory domain. You have a Microsoft 365 E5 subscription. You plan to implement a hybrid configuration that has the following requirements: • Minimizes the number of times users are prompted for credentials when they access Microsoft 365 resources • Supports the use of Azure AD Identity Protection You need to configure Azure AD Connect to support the planned implementation. Which two options should you select? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. Password Hash Synchronization; Enable single sign-on
Password Hash Synchronization and Enable Single Sign-On (seamless SSO) together provide a solution that minimizes credential prompts while supporting Identity Protection. Password Hash Synchronization synchronizes password hashes for seamless authentication, and seamless SSO automatically signs in users on domain-joined devices without prompting for credentials. This combination satisfies both requirements without requiring pass-through authentication.
Why the other options are wrong
- B. Password writeback is for on-premises password reset functionality, not for minimizing authentication prompts or supporting Identity Protection.
- C. Directory extension attribute sync extends specific attributes but does not address the credential prompt requirement.
- E. While pass-through authentication could work, it is not required when Password Hash Synchronization with seamless SSO is already in place.
Question 35
You have a Microsoft 365 E5 subscription. You need to recommend a solution for monitoring and reporting application access. The solution must meet the following requirements: • Support KQL for querying data. • Retain report data for at least one year. What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Monitor workbooks
Azure Monitor workbooks support KQL (Kusto Query Language) for querying data and can retain report data for extended periods exceeding one year. This solution meets both requirements for monitoring and reporting application access with flexible querying capabilities and long-term data retention.
Why the other options are wrong
- A. Security reports in Microsoft 365 Defender do not support KQL querying and have more limited retention periods.
- B. Endpoint analytics focuses on device health and performance, not application access monitoring with KQL support.
- C. Microsoft 365 usage analytics does not support KQL and has shorter data retention periods than required.
Question 36
You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?
Show answer and explanation
Correct answer: D. From the Microsoft 365 Defender portal, create an alert policy.
An activity-based alert policy in the Microsoft 365 Defender portal can trigger on sharing activities, such as a user sharing a file or folder, and email a chosen recipient like the HR manager. The policy can be filtered to the users or site involved. This fires on the act of sharing itself, regardless of the content.
Why the other options are wrong
- A. Sharing settings control who can share and with whom, but they do not notify a manager when sharing occurs.
- B. A SharePoint alert notifies on changes to lists or libraries, not on sharing actions performed by department users.
- C. A DLP policy triggers on sensitive content matching its conditions, not on every sharing action.
Question 37
Your network contains an Active Directory forest named contoso.local. You have a Microsoft 365 subscription. You plan to implement a directory synchronization solution that will use password hash synchronization. From the Microsoft 365 admin center, you successfully verify the contoso.com domain name. You need to prepare the environment for the planned directory synchronization solution. What should you do first?
Show answer and explanation
Correct answer: C. From Active Directory Domains and Trusts, add contoso.com as a UPN suffix.
Before implementing directory synchronization with password hash sync, you must add the verified Microsoft 365 domain (contoso.com) as a UPN suffix in Active Directory. This ensures that synchronized user accounts will have matching UPNs in both on-premises AD and Azure AD, which is a prerequisite for successful synchronization. The domain has already been verified in Microsoft 365, so the next step is to configure the on-premises environment.
Why the other options are wrong
- A. Verifying contoso.local in Microsoft 365 is unnecessary since only routable domains can be verified; the focus should be on configuring contoso.com as a UPN suffix in AD.
- B. Adding MX records is not part of directory synchronization preparation and is not required at this stage.
- D. Modifying UPN suffixes for all users should happen after adding the UPN suffix to Active Directory, not before.
Question 38
You have a Microsoft 365 E5 subscription. You onboard all devices to Microsoft Defender for Endpoint. You need to use Defender for Endpoint to block access to a malicious website at www.contoso.com. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
Show answer and explanation
Correct answer: B, D. Enable Custom network indicators; Create an indicator.
Blocking one specific URL or domain in Defender for Endpoint is done with a URL/domain indicator set to block. For indicators to be enforced by network protection, the Custom network indicators advanced feature must first be turned on. Web content filtering works on categories of sites, not on a single named site.
Why the other options are wrong
- A. Web content filtering blocks whole site categories and cannot target one specific domain like www.contoso.com.
- C. Automated investigation handles alert remediation and does not block websites.
- E. An enforcement scope applies to antivirus and indicator enforcement for files, not to blocking a website.
Question 39
You have a Microsoft 365 subscription that contains an Azure AD tenant named contoso.com. The tenant includes a user named User1. You enable Azure AD Identity Protection. You need to ensure that User1 can review the list in Azure AD Identity Protection of users flagged for risk. The solution must use the principle of least privilege. To which role should you add User1?
Show answer and explanation
Correct answer: A. Security Reader
The Security Reader role provides read-only access to security information in Azure AD, including the ability to review users flagged for risk in Identity Protection. This role follows the principle of least privilege by granting only the necessary permissions to view risk information without administrative capabilities to modify settings or policies.
Why the other options are wrong
- B. Global Administrator has excessive permissions beyond what is needed to simply review risk information.
- C. Owner is not a standard Azure AD role and does not apply to this scenario.
- D. User Administrator does not have access to Identity Protection risk information and grants unnecessary user management permissions.
Question 40
You have a Microsoft 365 E5 subscription. You define a retention label that has the following settings: Retention period: 7 years - Start the retention period based on: When items were created You need to prevent the removal of the label once the label is applied to a file. What should you select in the retention label settings?
Show answer and explanation
Correct answer: B. Mark items as a regulatory record
Marking items as a regulatory record prevents the label from being removed once applied and also locks the retention settings so they cannot be modified. This is the strongest protection mechanism and meets the requirement to prevent removal of the label after application, which is essential for regulatory compliance scenarios.
Why the other options are wrong
- A. This option only specifies the retention period duration but does not prevent label removal.
- C. Marking as a record prevents deletion but still allows label removal in some contexts, whereas regulatory record provides stronger protection.
- D. This prevents item deletion but does not prevent the label itself from being removed.
Question 41
You have a Microsoft 365 E5 subscription that has Microsoft Defender for Endpoint integrated with Microsoft Intune. Devices are onboarded by using Microsoft Defender for Endpoint. You plan to block devices based on the results of the machine risk score calculated by Microsoft Defender for Endpoint. What should you create first?
Show answer and explanation
Correct answer: B. a device compliance policy
A device compliance policy is the first required step to integrate machine risk scores from Microsoft Defender for Endpoint into Intune. The compliance policy evaluates the risk score and marks devices as compliant or non-compliant, which can then be used as a condition in conditional access policies to block access.
Why the other options are wrong
- A. Device configuration policies manage settings but do not evaluate risk scores for compliance decisions.
- C. Conditional access policies use the compliance status as a condition but cannot be created first without an underlying compliance policy.
- D. Endpoint detection and response policies do not create the compliance framework needed for blocking decisions.
Question 42
You have a Microsoft 365 E5 subscription. You need to create a mail-enabled contact. Which portal should you use?
Show answer and explanation
Correct answer: A. the Microsoft 365 admin center
Mail-enabled contacts in Microsoft 365 are managed through the Microsoft 365 admin center, where administrators can create and manage contacts that appear in the Global Address List. This is the primary portal for managing Exchange-related objects including mail-enabled contacts.
Why the other options are wrong
- B. The SharePoint admin center manages SharePoint sites and resources, not Exchange contacts.
- C. The Microsoft Entra admin center (formerly Azure AD admin center) manages identity and access but not mail-enabled contacts.
- D. The Microsoft Purview compliance portal focuses on compliance and data governance, not contact management.
Question 43
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365 and contains a user named User1. User emails a product catalog in the PDF format to 300 vendors. Only 200 vendors receive the email message, and User1 is blocked from sending email until the next day. You need to prevent this issue from reoccurring. What should you configure?
Show answer and explanation
Correct answer: A. anti-spam policies
User1 is being blocked from sending email after sending to 300 recipients, with only 200 receiving it. This is a classic symptom of anti-spam policy throttling or outbound spam detection. Anti-spam policies in Microsoft Defender for Office 365 enforce recipient rate limits and can temporarily block users who exceed thresholds, preventing bulk mail from being delivered and blocking further sends. To prevent this, the recipient limit in anti-spam policies must be increased or configured appropriately.
Why the other options are wrong
- B. Safe Attachments policies protect against malicious attachments but don't affect bulk sending limits or delivery throttling.
- C. Anti-phishing policies detect phishing attempts and suspicious emails but don't restrict outbound email sending rates.
- D. Anti-malware policies scan for malware in attachments and messages but don't impose sending limits on users.
Question 44
You have a Microsoft 365 E5 subscription that contains a user named User1. You create a retention label named Retention1 that is published to all locations. You need to ensure that User1 can label email messages by using Retention1 as soon as possible. Which cmdlet should you run in Microsoft Exchange Online PowerShell?
Show answer and explanation
Correct answer: A. Start-ManagedFolderAssistant
The Start-ManagedFolderAssistant cmdlet in Exchange Online PowerShell triggers the Managed Folder Assistant to process retention policies and labels immediately on user mailboxes. Running this cmdlet ensures that User1 can access and apply the newly published Retention1 label to email messages as soon as possible, rather than waiting for the automatic daily processing cycle.
Why the other options are wrong
- B. Start-MpScan is used for antimalware scanning and is unrelated to retention label activation.
- C. Start-AppBackgroundTask is not an Exchange Online cmdlet relevant to retention label deployment.
- D. Start-Process is a generic PowerShell cmdlet for starting processes and does not apply retention labels in Exchange Online.
Question 45
You have a Microsoft 365 subscription. You plan to use Adoption Score and need to ensure that it can obtain device and software metrics. What should you do?
Show answer and explanation
Correct answer: B. Enable Endpoint analytics.
Endpoint analytics must be enabled to allow Adoption Score to collect device and software metrics from managed devices. Endpoint analytics provides the necessary hardware and software inventory data that Adoption Score uses to calculate organizational technology adoption and modernization insights.
Why the other options are wrong
- A. Privileged access management is for administrative access control, not device metrics collection.
- C. Support integration assists with troubleshooting but does not provide device and software metrics.
- D. Network connectivity tests validate network performance but do not enable the device and software metric collection required by Adoption Score.
Question 46
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365 and contains a mailbox named Mailbox1. You plan to use Mailbox1 to collect and analyze unfiltered email messages. You need to ensure that Defender for Office 365 takes no action on any inbound emails delivered to Mailbox1. What should you do?
Show answer and explanation
Correct answer: C. Configure Mailbox1 as a SecOps mailbox.
A SecOps mailbox in Microsoft Defender for Office 365 is specifically designed for security operations teams to collect and analyze unfiltered email messages. When a mailbox is configured as a SecOps mailbox, Defender for Office 365 bypasses protection actions and delivers all messages unfiltered, allowing security personnel to perform threat analysis and investigation without interference from protective filtering.
Why the other options are wrong
- A. A retention policy governs how long messages are kept but does not prevent Defender actions on inbound emails.
- B. A mail flow rule can redirect or modify messages but is not the correct mechanism to suppress Defender for Office 365 actions.
- D. Litigation hold preserves mailbox content but does not prevent Defender for Office 365 from taking protective actions on inbound messages.
Question 47
You have a Microsoft 365 E5 tenant. You need to create a policy that will trigger an alert when unusual Microsoft Office 365 usage patterns are detected. What should you use to create the policy?
Show answer and explanation
Correct answer: D. the Microsoft 365 Defender portal
Policies that trigger alerts for unusual Microsoft Office 365 usage patterns are created in the Microsoft 365 Defender portal, where threat and anomaly detection rules are configured. This portal provides the interface for setting up behavioral detection rules and alert policies specific to cloud application usage.
Why the other options are wrong
- A. The Microsoft Apps admin center manages app deployments and settings, not security alerts.
- B. The Microsoft Purview compliance portal focuses on data protection and compliance, not usage anomaly detection.
- C. The Microsoft 365 admin center handles general tenant management but not security alert policy creation.
Question 48
You have a Microsoft 365 E5 subscription that uses Endpoint security. You need to create a group and assign the Endpoint Security Manager role to the group. Which type of group can you use?
Show answer and explanation
Correct answer: C. mail-enabled security and security only
The Endpoint Security Manager role can be assigned to mail-enabled security groups and security groups only. These are the two group types supported for role assignment in Endpoint Security within Microsoft 365. Microsoft 365 groups and distribution groups cannot be used for this purpose.
Why the other options are wrong
- A. Microsoft 365 groups alone cannot be assigned the Endpoint Security Manager role.
- B. While security groups are supported, mail-enabled security groups must also be included in the answer.
- D. Microsoft 365 groups are not supported for Endpoint Security Manager role assignment.
- E. Distribution groups and Microsoft 365 groups are not supported for this role assignment.
Question 49
You have a Microsoft 365 subscription that contains an Azure AD tenant named contoso.com. Corporate policy states that user passwords must not include the word Contoso. What should you do to implement the corporate policy?
Show answer and explanation
Correct answer: B. From the Microsoft Entra admin center, configure the Password protection settings.
Password protection settings in Microsoft Entra admin center allow you to configure custom banned password lists and enforce prohibitions on specific words like 'Contoso'. This feature enables organizations to implement custom password policies beyond default complexity requirements, making it the correct tool for enforcing that passwords cannot contain the word 'Contoso'.
Why the other options are wrong
- A. Conditional access policies control access based on conditions but do not enforce password composition requirements.
- C. Microsoft 365 admin center password policy settings do not include custom word banning capabilities.
- D. Azure AD Identity Protection sign-in risk policies address risky sign-in detection, not password composition enforcement.
Question 50
You have a Microsoft 365 E5 subscription. You plan to create a data loss prevention (DLP) policy that will be applied to all available locations. Which conditions can you use in the DLP rules of the policy?
Show answer and explanation
Correct answer: A. sensitive info types
DLP rules use sensitive info types as conditions to identify protected content. Sensitive info types are patterns that detect PII, financial data, health information, and other regulated data. Sensitive info types are the primary and most accurate mechanism for DLP conditions across all locations, since they provide pattern-based detection of regulated data. Keywords can be part of detection, but sensitive info types are the foundational condition type for comprehensive DLP policies.
Why the other options are wrong
- B. Content search queries are used in eDiscovery and content search, not as DLP rule conditions.
- C. While keywords can be part of DLP detection, they are not the primary or most comprehensive condition type compared to sensitive info types.
- D. Sensitivity labels classify content but are not conditions used to create DLP rules; they are applied based on rules or manual assignment.
Question 51
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain. You deploy an Azure AD tenant. Another administrator configures the domain to synchronize to Azure AD. You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully. You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully. You need to ensure that the 10 user accounts are synchronized to Azure AD. Solution: You run idfix.exe and export the 10 user accounts. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Running idfix.exe only identifies and reports on Active Directory attribute errors that could prevent synchronization; it does not actually synchronize accounts or resolve the underlying filtering issue. The fact that Azure AD Connect Health shows all synchronizations completed successfully suggests the 10 accounts are being filtered out by Azure AD Connect configuration (such as OU filtering, domain filtering, or object type filtering), not prevented by directory errors. Exporting accounts with idfix.exe would not resolve this filtering configuration issue.
Why the other options are wrong
- A. Exporting accounts does not perform synchronization or modify Azure AD Connect's filtering configuration that is preventing these 10 accounts from syncing.
Question 52
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription. You create an account for a new security administrator named SecAdmin1. You need to ensure that SecAdmin1 can manage Microsoft Defender for Office 365 settings and policies for Microsoft Teams, SharePoint, and OneDrive. Solution: From the Microsoft 365 admin center, you assign SecAdmin1 the SharePoint Administrator role. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The SharePoint Administrator role only provides management capabilities for SharePoint specifically and does not grant permissions to manage Microsoft Defender for Office 365 settings and policies across Teams, SharePoint, and OneDrive. A more comprehensive security-focused role is required.
Why the other options are wrong
- A. The SharePoint Administrator role is limited to SharePoint administration and cannot manage Defender for Office 365 settings across multiple services.
Question 53
Your company has on-premises servers and an Azure AD tenant. Several months ago, the Azure AD Connect Health agent was installed on all the servers. You review the health status of all the servers regularly. Recently, you attempted to view the health status of a server named Server1 and discovered that the server is NOT listed on the Azure AD Connect Servers list. You suspect that another administrator removed Server1 from the list. You need to ensure that you can view the health status of Server1. What are two possible ways to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C. From Windows PowerShell, run the Register-AzureADConnectHealthSyncAgent cmdlet; From Server1, reinstall the Azure AD Connect Health agent.
To restore the health status view for Server1, you can either re-register the agent using the Register-AzureADConnectHealthSyncAgent PowerShell cmdlet or reinstall the Azure AD Connect Health agent on Server1. Both approaches will re-establish the connection and restore the server's appearance in the Azure AD Connect Servers list.
Why the other options are wrong
- B. The Connect-AzureAD cmdlet is for general Azure AD connections, not for registering the Connect Health agent.
- D. Changing the service startup type to Automatic will not re-register the agent or add the server back to the list.
- E. Changing the startup type to Automatic (Delayed Start) will not restore the server to the Azure AD Connect Servers list.
Question 54
You have a Microsoft 365 subscription. All users are assigned Microsoft 365 Apps for enterprise licenses. You need to ensure that reports display the names of users that have activated Microsoft 365 apps and on how many devices. What should you modify in the Microsoft 365 admin center?
Show answer and explanation
Correct answer: D. Org settings for Reports
To ensure that reports display the names of users who have activated Microsoft 365 Apps and the number of devices they activated on, you must modify the Org settings for Reports in the Microsoft 365 admin center. This setting controls the privacy level and determines whether user-identifying information is displayed in activation reports.
Why the other options are wrong
- A. The Reports reader role controls who can access reports, not how user data is displayed in them.
- B. Organization information settings do not control report privacy or user identification display.
- C. Privacy profile org settings relate to general privacy but not specifically to app activation report display.
Question 55
Your network contains an Active Directory domain named adatum.com that is synced to Azure AD. The domain contains 100 user accounts. The city attribute for all the users is set to the city where the user resides. You need to modify the value of the city attribute to the three-letter airport code of each city. What should you do?
Show answer and explanation
Correct answer: A. From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.
Since the task requires modifying the city attribute for user accounts in an on-premises Active Directory domain (adatum.com), you must use Get-ADUser and Set-ADUser cmdlets from Windows PowerShell on a domain controller. These cmdlets interact directly with on-premises AD, not Azure AD. The city attribute is an on-premises AD property that needs to be updated locally before any sync to Azure AD occurs.
Why the other options are wrong
- B. Azure Cloud Shell cannot execute Get-ADUser and Set-ADUser cmdlets as these are designed for on-premises Active Directory management, not Azure AD.
- C. Get-MgUser and Update-MgUser cmdlets are Microsoft Graph cmdlets used for Azure AD/Microsoft Entra ID, not on-premises Active Directory.
- D. Azure Cloud Shell combined with Microsoft Graph cmdlets cannot modify on-premises Active Directory attributes directly.
Question 56
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint. All the devices in your organization are onboarded to Microsoft Defender for Endpoint. You need to ensure that an alert is generated if malicious activity was detected on a device during the last 24 hours. What should you do?
Show answer and explanation
Correct answer: C. From Advanced hunting, create a query and a detection rule.
Creating a custom detection rule in Advanced hunting is the appropriate method to generate alerts for malicious activity detected in the last 24 hours. Advanced hunting allows you to write custom queries to identify specific threat patterns, and detection rules created from these queries will generate alerts when the conditions are met.
Why the other options are wrong
- A. DLP policies are for preventing data loss, not for detecting malware or suspicious device activity.
- B. Suppression rules are used to silence existing alerts, not to create new ones based on detection patterns.
- D. Audit log searches are for reviewing historical activities, not for generating real-time alerts about malicious activity.
Question 57
You have a Microsoft 365 E5 subscription. Conditional Access is configured to block high-risk sign-ins for all users. All users are in France and are registered for multi-factor authentication (MFA). Users in the media department will travel to various countries during the next month. You need to ensure that if the media department users are blocked from signing in while traveling, the users can remediate the issue without administrator intervention. What should you configure?
Show answer and explanation
Correct answer: D. self-service password reset (SSPR)
A risk-based block can be remediated by the user by resetting the password, which clears the user risk. With self-service password reset configured, and users already registered for MFA, media users who are blocked while traveling can remediate the risk themselves without administrator intervention.
Why the other options are wrong
- A. An exclusion group removes users from the policy rather than letting them remediate a block themselves.
- B. Users are already registered for MFA, and the registration policy does not let them clear a risk-based block.
- C. Named locations define trusted networks or countries but give users no way to remediate a block themselves.
Question 58
You have a Microsoft 365 subscription. You add a domain named contoso.com. When you attempt to verify the domain, you are prompted to send a verification email to admin@contoso.com. You need to change the email address used to verify the domain. What should you do?
Show answer and explanation
Correct answer: B. From the domain registrar, modify the contact information of the domain.
The verification email address for a domain is typically associated with the domain registrar's contact information. To change the email address used for domain verification, you must modify the contact information at the domain registrar where the domain is registered.
Why the other options are wrong
- A. Adding a TXT record is used for DNS verification but does not change the verification email address.
- C. Changing the global administrator does not alter the domain verification email address used by the registrar.
- D. Modifying NS records changes the authoritative nameservers but not the verification email contact information.
Question 59
You have a Microsoft 365 E3 subscription that uses Microsoft Defender for Endpoint Plan 1. Which two Defender for Endpoint features are available to the subscription? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, E. security reports; attack surface reduction (ASR)
Microsoft Defender for Endpoint Plan 1 includes security reports and attack surface reduction (ASR) as core features. Security reports provide visibility into threat detection and remediation activities, while ASR rules help prevent malware execution and exploitation. Advanced hunting, digital certificate assessment, and device discovery are features available in higher-tier plans or as separate offerings, not in Plan 1.
Why the other options are wrong
- A. Advanced hunting is a feature available in Microsoft Defender for Endpoint Plan 2, not Plan 1.
- C. Digital certificate assessment is not a standard feature of Defender for Endpoint Plan 1.
- D. Device discovery is a feature available in higher-tier plans or requires separate licensing beyond Plan 1.
Question 60
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain. You deploy an Azure AD tenant. Another administrator configures the domain to synchronize to Azure AD. You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully. You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully. You need to ensure that the 10 user accounts are synchronized to Azure AD. Solution: From Azure AD Connect, you modify the Azure AD credentials. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Modifying Azure AD credentials in Azure AD Connect affects the account used to write to Azure AD, not the filtering of which on-premises accounts are synchronized. The issue is that 10 specific accounts in an OU are not being synchronized, which indicates a filtering rule (OU filtering, domain filtering, etc.) is preventing them from syncing. Azure AD credentials have no impact on which source objects are selected for synchronization.
Why the other options are wrong
- A. Changing Azure AD credentials does not resolve OU or object-level filtering that prevents specific accounts from being included in the synchronization scope.
Question 61
You have a Microsoft 365 E5 subscription. From the Microsoft 365 Defender portal, you plan to export a detailed report of compromised users. What is the longest time range that can be included in the report?
Show answer and explanation
Correct answer: C. 30 days
The longest time range that can be included when exporting a detailed report of compromised users from the Microsoft 365 Defender portal is 30 days. This constraint ensures manageable report sizes and performance while still providing sufficient data for investigation and remediation of compromised user accounts.
Why the other options are wrong
- A. 1-day range is too limited for comprehensive compromised user analysis.
- B. 7-day range does not provide the full 30-day export capability.
- D. 90-day range exceeds the maximum export time range limit for compromised user reports.
Question 62
You have a Microsoft 365 E5 subscription. You need to be alerted when Microsoft 365 Defender detects high-severity incidents. What should you use?
Show answer and explanation
Correct answer: C. an alert policy
An alert policy in Microsoft 365 Defender is the correct tool to receive notifications when high-severity incidents are detected. Alert policies can be configured with specific triggers based on incident severity and will send notifications to designated recipients when those conditions are met.
Why the other options are wrong
- A. Custom detection rules are for creating custom indicators in advanced hunting but are primarily for hunting, not alert generation.
- B. Threat policies are not a standard Microsoft 365 Defender configuration option for incident alerts.
- D. Notification rules are not a standard feature in Microsoft 365 Defender; alert policies are the correct mechanism.
Question 63
You have a Microsoft 365 E5 subscription. You create a Conditional Access policy that blocks access to an app named App1 when users trigger a high-risk sign-in event. You need to reduce false positives for impossible travel when the users sign in from the corporate network. What should you configure?
Show answer and explanation
Correct answer: C. named locations
Named locations in Conditional Access allow you to define trusted network locations (such as the corporate network) that are excluded from risk-based policies. By configuring the corporate network as a named location, impossible travel detections triggered when users sign in from that network will be reduced, as Azure AD will recognize it as a trusted location and not flag it as anomalous.
Why the other options are wrong
- A. Exclusion groups exempt specific users from the policy entirely, which does not address reducing false positives for a specific risk condition.
- B. Multi-factor authentication requirements do not reduce false positives; they add friction without solving the underlying risk detection issue.
- D. User risk policies operate on different risk levels and do not specifically address impossible travel scenarios from known networks.
Question 64
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. From Microsoft Defender for Endpoint, you turn on the Allow or block file advanced feature. You need to block users from downloading a file named File1.exe. What should you use?
Show answer and explanation
Correct answer: B. an indicator
Indicators in Microsoft Defender for Endpoint are used to block or allow specific files, URLs, or IP addresses. When you enable the 'Allow or block file' advanced feature, you create indicators to specify which files should be blocked or allowed. This is the appropriate mechanism to block users from downloading File1.exe across managed devices.
Why the other options are wrong
- A. Suppression rules are used to suppress alerts and notifications, not to block file downloads at the endpoint.
- C. Device configuration profiles manage device settings and policies but are not the tool for blocking specific file downloads in Defender for Endpoint.
Question 65
Your network contains three Active Directory forests. There are forests trust relationships between the forests. You create an Azure AD tenant. You plan to sync the on-premises Active Directory to Azure AD. You need to recommend a synchronization solution. The solution must ensure that the synchronization can complete successfully and as quickly as possible if a single server fails. What should you include in the recommendation?
Show answer and explanation
Correct answer: A. one Azure AD Connect sync server and one Azure AD Connect sync server in staging mode
For three forests with trust relationships, a single Azure AD Connect sync server (active) paired with one staging mode server provides high availability and redundancy. If the primary server fails, the staging server can be promoted to active role to resume synchronization. This configuration is cost-effective for multiple forests while ensuring synchronization can continue if a single server fails. Additional servers beyond this pair add unnecessary complexity without improving failure recovery speed.
Why the other options are wrong
- B. Three active sync servers cannot coexist; Azure AD Connect topology supports only one active and one staging server per tenant to prevent conflicts.
- C. Six active servers with three staging servers is excessive and violates Azure AD Connect architectural constraints; only one active server is supported.
- D. Three active servers cannot run simultaneously; Azure AD Connect does not support multiple active sync servers in the same tenant.
Question 66
You have a Microsoft 365 subscription. You need to receive a notification each time a user in the service desk department grants Full Access permissions for a user mailbox. What should you configure?
Show answer and explanation
Correct answer: B. an alert policy
An alert policy in Microsoft 365 is specifically designed to send notifications when specific activities occur, such as granting mailbox permissions. Alert policies can be configured to trigger when users in the service desk department grant Full Access permissions and will notify the designated recipients in real-time.
Why the other options are wrong
- A. DLP policies are designed to prevent data exfiltration, not to generate notifications about permission changes.
- C. Audit searches allow you to search historical audit logs but do not generate automatic notifications.
- D. Insider risk management policies focus on risky user behaviors and data exfiltration, not mailbox permission grants.
Question 67
You have a Microsoft 365 E5 subscription. You need to ensure that administrators receive an email when Microsoft 365 Defender detects a sign-in from a risky IP address. What should you create?
Show answer and explanation
Correct answer: B. an alert
In Microsoft 365 Defender, alerts are the mechanism used to notify administrators about detected security events such as sign-ins from risky IP addresses. You create alerts in the Microsoft 365 Defender portal to define conditions and notification recipients for specific threat scenarios.
Why the other options are wrong
- A. Vulnerability notification rules are for software vulnerabilities, not sign-in risks.
- C. Incident assignment filters manage incident routing, not email notifications to administrators.
- D. Incident notification rules do not exist as a primary configuration option for this scenario.
Question 68
You have a Microsoft 365 subscription that contains a user named User1. User1 requires admin access to perform the following tasks: Manage Microsoft Exchange Online settings. Create Microsoft 365 groups. You need to ensure that User1 only has admin access for eight hours and requires approval before the role assignment takes place. What should you use?
Show answer and explanation
Correct answer: D. Azure AD Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) is the correct solution for assigning admin roles with time-limited access (eight hours) that require approval before activation. PIM provides just-in-time (JIT) privileged access management with configurable activation durations and approval workflows, which is exactly what is needed for User1's Exchange Online and Microsoft 365 Groups management tasks.
Why the other options are wrong
- A. Azure AD Identity Protection focuses on identifying and remediating identity risks, not on managing privileged role assignments with time limits and approvals.
- B. Microsoft Entra Verified ID is used for identity verification and credential management, not for managing administrative role assignments.
- C. Conditional Access policies control access based on conditions but do not provide the time-limited, approval-based role assignment functionality needed here.
Question 69
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain. You deploy an Azure AD tenant. Another administrator configures the domain to synchronize to Azure AD. You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully. You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully. You need to ensure that the 10 user accounts are synchronized to Azure AD. Solution: From Azure AD Connect, you modify the filtering settings. Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
If Azure AD Connect Health shows all synchronizations completed successfully but 10 user accounts from a specific OU are not appearing in Azure AD, this indicates a filtering configuration issue. Modifying filtering settings in Azure AD Connect, specifically enabling the OU containing those 10 users if it was previously filtered out, will ensure they are synchronized. This directly addresses the root cause of the synchronization absence.
Why the other options are wrong
- B. This option incorrectly states that modifying filtering settings would not meet the goal, when in fact filtering configuration is the most likely cause of selective synchronization failures when health reports show success.
Question 70
You have a Microsoft 365 subscription. You have a data loss prevention (DLP) policy that blocks sensitive data from being shared in email messages. You need to modify the policy so that when an email message containing sensitive data is sent to both external and internal recipients, the message is only prevented from being delivered to the external recipients. What should you modify?
Show answer and explanation
Correct answer: D. the policy rule actions
To configure a DLP policy to prevent delivery to external recipients while allowing delivery to internal recipients, you must modify the policy rule actions. The actions define what happens when the policy is triggered. By configuring the action to block external recipients specifically while allowing internal delivery, you achieve selective enforcement based on recipient type.
Why the other options are wrong
- A. Exceptions define what content to exclude from the rule but cannot differentiate actions based on recipient type.
- B. Locations determine which services the policy applies to (Exchange, SharePoint, Teams) but not recipient-based delivery decisions.
- C. Conditions identify what triggers the rule but do not control the differential actions applied to different recipient types.
Question 71
Your network contains an on-premises Active Directory domain named contoso.com. For all user accounts, the Logon Hours settings are configured to prevent sign-ins outside of business hours. You plan to sync contoso.com to an Azure AD tenant You need to recommend a solution to ensure that the logon hour restrictions apply when synced users sign in to Azure AD. What should you include in the recommendation?
Show answer and explanation
Correct answer: A. pass-through authentication
Pass-through authentication validates credentials against the on-premises Active Directory at sign-in time, which means on-premises logon hour restrictions are enforced during authentication. Since each sign-in request is validated against the live on-premises AD, the logon hour settings configured in Active Directory apply when synced users attempt to sign in to Azure AD.
Why the other options are wrong
- B. Conditional Access policies cannot directly enforce on-premises Active Directory logon hour restrictions; they only apply Azure AD-based conditions.
- C. Password synchronization only replicates password hashes and does not enforce on-premises logon hour restrictions during sign-in.
- D. Azure AD Identity Protection policies detect and respond to risky sign-ins but do not enforce on-premises logon hour restrictions.
Question 72
You have a Microsoft 365 E5 subscription. You need to create Conditional Access policies to meet the following requirements: All users must use multi-factor authentication (MFA) when they sign in from outside the corporate network. Users must only be able to sign in from outside the corporate network if the sign-in originates from a compliant device. All users must be blocked from signing in from outside the United States and Canada. Only users in the R&D department must be blocked from signing in from both Android and iOS devices. Only users in the finance department must be able to sign in to an Azure AD enterprise application named App1. All other users must be blocked from signing in to App1. What is the minimum number of Conditional Access policies you should create?
Show answer and explanation
Correct answer: B. 4
Four policies are required: (1) All users require MFA from outside corporate network, (2) Users outside corporate network must use compliant devices, (3) Block all users from non-US/Canada locations, (4) R&D blocked from Android/iOS must be separate from (5) Finance-only access to App1. However, requirements 1 and 2 can be combined into one policy with multiple conditions, requirement 3 stands alone, requirement 4 (R&D device restriction) can be one policy, and requirements 5 (Finance access to App1) requires one policy, totaling 4 minimum policies.
Why the other options are wrong
- A. Three policies is insufficient to address all five distinct requirements
- C. Five policies is excessive; several requirements can be combined within single policies
- D. Six policies exceeds the minimum required
- E. Seven policies exceeds the minimum required
- F. Eight policies exceeds the minimum required
Question 73
You have a Microsoft 365 ES subscription. On Monday, you create a new user named User1. On Tuesday, User1 signs in for the first time and perform the following actions: • Signs in to Microsoft Exchange Online from an anonymous IP address. • Signs in to Microsoft SharePoint Online from a device in New York City. • Establishes Remote Desktop connections to hosts in Berlin and Hong Kong, and then signs in to SharePoint Online from the Remote Desktop connections. Which types of sign-in risks will Azure AD Identity Protection detect for User1?
Show answer and explanation
Correct answer: B. anonymous IP address only
Azure AD Identity Protection detects anonymous IP address sign-ins as a risk type. However, it does not detect atypical travel automatically for a newly created user on their first sign-in because the system lacks baseline behavior data. Similarly, unfamiliar sign-in properties require established sign-in patterns to compare against. Only the anonymous IP address sign-in from Exchange Online qualifies as a detectable risk for a new user.
Why the other options are wrong
- A. Atypical travel is not detected for new users without established baseline behavior patterns.
- C. Neither unfamiliar sign-in properties nor atypical travel are detected reliably for a user on their first day of sign-in activity.
- D. Unfamiliar sign-in properties cannot be detected without prior baseline behavior data for comparison.
- E. Atypical travel and unfamiliar sign-in properties are not detected for newly created users lacking historical behavior data.
Question 74
You have a Microsoft 365 E5 subscription. Users access Microsoft 365 from both their laptop and a corporate Virtual Desktop Infrastructure (VDI) solution. From Azure AD Identity Protection, you enable a sign-in risk policy. Users report that when they use the VDI solution, they are regularly blocked when they attempt to access Microsoft 365. What should you configure?
Show answer and explanation
Correct answer: B. a trusted location
VDI solutions often present with atypical sign-in risk characteristics (such as shared IP addresses or unusual login patterns) that trigger sign-in risk policies. Configuring a trusted location for the VDI environment's IP range exempts those sign-ins from risk evaluation, preventing legitimate VDI users from being blocked while maintaining risk policies for other sign-in scenarios.
Why the other options are wrong
- A. Tenant restrictions settings control which external tenants users can access, not whether sign-in risk policies apply to specific locations.
- C. A Conditional Access policy exclusion would exclude the VDI users entirely from the risk policy, but a trusted location more precisely addresses the risk calculation issue.
- D. Microsoft 365 network connectivity settings do not affect Azure AD Identity Protection sign-in risk evaluation.
Question 75
You are reviewing alerts in the Microsoft 365 Defender portal. How long are the alerts retained in the portal?
Show answer and explanation
Correct answer: D. 6 months
Alerts in the Microsoft 365 Defender portal are retained for 6 months. This retention period allows security teams adequate time to investigate, respond to, and analyze security incidents. The 6-month retention applies to most alert types within the portal's unified incident and alert management system.
Why the other options are wrong
- A. 30-day retention is too short for enterprise security investigations and compliance requirements.
- B. 60-day retention falls short of the actual 6-month retention period.
- C. 3-month retention does not match the actual retention policy.
- E. 12-month retention exceeds the standard 6-month retention period in the Microsoft 365 Defender portal.
Question 76
You have a Microsoft 365 subscription. You need to add additional onmicrosoft.com domains to the subscription. The additional domains must be assignable as email addresses for users. What is the maximum number of onmicrosoft.com domains the subscription can contain?
Show answer and explanation
Correct answer: C. 5
Microsoft 365 subscriptions can contain a maximum of 5 onmicrosoft.com domains. These domains can be used for email addresses and are useful for testing, service accounts, and organizational separation. While you can add custom domains beyond this, the onmicrosoft.com domains specifically are limited to 5 per subscription.
Why the other options are wrong
- A. One onmicrosoft.com domain is insufficient; up to 5 are allowed.
- B. Two onmicrosoft.com domains is below the maximum allowed limit of 5.
- D. Ten exceeds the maximum of 5 onmicrosoft.com domains per subscription.
Question 77
You have a Microsoft 365 subscription. You need to create a data loss prevention (DLP) policy that is configured to use the Set headers action. To which location can the policy be applied?
Show answer and explanation
Correct answer: A. Exchange email
The Set headers action in DLP policies is only available for Exchange email. This action allows DLP to add X-headers to email messages that match policy conditions, which can be used for mail flow rules and filtering. Other locations like Teams, SharePoint, and OneDrive do not support the Set headers action.
Why the other options are wrong
- B. OneDrive does not support the Set headers action; only blocking and notification actions are available.
- C. SharePoint does not support the Set headers action; available actions include restricting access and notifications.
- D. Teams chat and channel messages do not support the Set headers action; only restriction and notification options exist.
Question 78
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription. You create an account for a new security administrator named SecAdmin1. You need to ensure that SecAdmin1 can manage Microsoft Defender for Office 365 settings and policies for Microsoft Teams, SharePoint, and OneDrive. Solution: From the Microsoft 365 admin center, you assign SecAdmin1 the Teams Administrator role. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The Teams Administrator role is limited to Teams management and configuration. It does not grant permissions to manage Microsoft Defender for Office 365 settings and policies across Teams, SharePoint, and OneDrive, which requires a security-focused role with broader scope.
Why the other options are wrong
- A. The Teams Administrator role manages Teams specifically but lacks the security permissions needed for Defender for Office 365 across multiple services.
Question 79
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription. You create an account for a new security administrator named SecAdmin1. You need to ensure that SecAdmin1 can manage Microsoft Defender for Office 365 settings and policies for Microsoft Teams, SharePoint, and OneDrive. Solution: From the Microsoft 365 admin center, you assign SecAdmin1 the Exchange Administrator role. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The Exchange Administrator role is limited to Exchange and email-related management. It does not provide the necessary permissions to manage Microsoft Defender for Office 365 settings and policies for Teams, SharePoint, and OneDrive, which require broader security admin permissions.
Why the other options are wrong
- A. The Exchange Administrator role is scoped to Exchange administration only and cannot manage Defender for Office 365 across Teams, SharePoint, and OneDrive.
Question 80
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory domain. You deploy an Azure AD tenant. Another administrator configures the domain to synchronize to Azure AD. You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully. You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully. You need to ensure that the 10 user accounts are synchronized to Azure AD. Solution: From the Synchronization Rules Editor, you create a new outbound synchronization rule. Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Creating a new outbound synchronization rule would not resolve the issue because outbound rules control what attributes sync to Azure AD, not which objects are included in the sync process. The 10 accounts are already synchronized according to Azure AD Connect Health (all synchronizations completed), meaning they reached Azure AD. The filtering preventing them from appearing in Azure AD is likely due to inbound rule filtering or OU-level scope settings. A new outbound rule cannot override or bypass inbound filtering.
Why the other options are wrong
- A. New outbound synchronization rules control attribute flow, not object-level filtering or inclusion in the synchronization scope.
Question 81
Your on-premises network contains an Active Directory domain. You have a Microsoft 365 subscription. You need to sync the domain with the subscription. The solution must meet the following requirements: On-premises Active Directory password complexity policies must be enforced. Users must be able to use self-service password reset (SSPR) in Azure AD. What should you use?
Show answer and explanation
Correct answer: D. pass-through authentication
Pass-through authentication validates user credentials against the on-premises Active Directory during sign-in, which enforces on-premises password complexity policies in real-time. It also supports self-service password reset when configured with password writeback, allowing users to reset passwords in Azure AD which write back to on-premises AD while maintaining complexity policy enforcement.
Why the other options are wrong
- A. Password hash synchronization does not enforce on-premises password complexity policies; it only syncs password hashes and does not validate against live on-premises policies.
- B. Azure AD Identity Protection is a security monitoring and response tool, not an authentication method that enforces password policies.
- C. Azure AD Seamless SSO enables silent sign-on but does not enforce on-premises password complexity policies during authentication.
Question 82
You have a Microsoft 365 E5 subscription. From the Microsoft Purview compliance portal, you create a new data loss prevention (DLP) policy named DLP1 that protects financial data from being shared by using Microsoft Teams messages. You apply DLP1 to the users in the finance department. An incident is raised when a finance department user named User1 shares financial data in a Teams channel that includes external members. When User1 uses Teams to send the same message in a 1:1 chat or a private channel, the message is blocked as expected. You need to ensure that User1 is prevented from sharing financial data in Teams channels that include external members. What should you do?
Show answer and explanation
Correct answer: D. Edit the policy rules of DLP1.
The issue is that DLP1 is not blocking sharing in Teams channels with external members while correctly blocking 1:1 and private channel messages. This inconsistency requires editing the policy rules of DLP1 to adjust the conditions and actions specifically for Teams channels with external members, ensuring the blocking behavior is consistent across all channel types.
Why the other options are wrong
- A. Team settings control general team behavior but do not override or refine DLP policy actions.
- B. Locations settings define which workloads (Teams, Exchange, etc.) the policy applies to, not the behavior for specific channel types.
- C. User licensing does not affect DLP policy enforcement; the issue is policy configuration, not permissions.
Question 83
You have a Microsoft 365 E5 subscription. Users have Android or iOS devices and access Microsoft 365 resources from computers that run Windows 11 or MacOS. You need to implement passwordless authentication. The solution must support all the devices. Which authentication method should you use?
Show answer and explanation
Correct answer: C. Microsoft Authenticator app
The Microsoft Authenticator app is the only method that supports passwordless authentication across all the specified platforms: Windows 11, MacOS, Android, and iOS. It works universally through phone sign-in and push notifications, making it the most broadly compatible passwordless solution for heterogeneous device environments.
Why the other options are wrong
- A. Windows Hello only supports Windows 11 and MacOS devices, not Android or iOS.
- B. FIDO2 security keys provide good support but require physical key hardware and have limited iOS support compared to the Authenticator app.
Question 84
You are testing a data loss prevention (DLP) policy to protect the sharing of credit card information with external users. During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint. You need to prevent the user from sharing the credit card information by using email and SharePoint. What should you configure?
Show answer and explanation
Correct answer: A. the locations of the DLP policy
The issue is that email is not being protected while SharePoint is. This indicates the DLP policy's locations are not properly configured to include Exchange (email). By configuring the locations of the DLP policy to include both Exchange and SharePoint, you ensure that credit card information is protected across both channels.
Why the other options are wrong
- B. Conditions define what sensitive data triggers the policy but don't determine which services are protected.
- C. User overrides allow users to bypass the policy and are not the appropriate control here.
- D. The policy status being enabled or disabled affects all locations equally, not selective service protection.
Question 85
You have a Microsoft 365 subscription. You need to be notified to your personal email address when a Microsoft Exchange Online service issue occurs. What should you do?
Show answer and explanation
Correct answer: D. From the Microsoft 365 admin center, customize the Service health settings.
To receive notifications about Microsoft 365 service issues to a personal email address, 2. User1 has department 'IT engineering', which the answer treats as satisfying you must customize the Service health settings in the Microsoft 365 admin center. This setting allows you to configure which email addresses receive service health alerts when issues occur with services like Exchange Online.
Why the other options are wrong
- A. Creating a contact in Exchange admin center does not set up service health notifications.
- B. Configuring Outlook rules does not enable service health notifications from Microsoft 365.
- C. Technical contact details are used for support but do not configure service health notifications.
Question 86
You have a Microsoft 365 E5 subscription that uses Microsoft Intune. You need to access service health alerts from a mobile phone. What should you use?
Show answer and explanation
Correct answer: B. the Microsoft 365 Admin mobile app
The Microsoft 365 Admin mobile app is the appropriate tool for accessing service health alerts and other administrative functions from a mobile phone. It provides access to the service health dashboard and notifications specific to your Microsoft 365 subscription.
Why the other options are wrong
- A. The Microsoft Authenticator app is used for authentication, not for viewing service health alerts.
- C. Intune Company Portal is focused on device and app management, not service health monitoring.
- D. The Intune app is for app protection and management, not for accessing service health information.
Question 87
You have a Microsoft 365 E5 subscription. The subscription contains users that have the following types of devices: • Windows 11 • Android • iOS To which devices can you apply Endpoint DLP policies?
Show answer and explanation
Correct answer: A. Windows 11 only
Endpoint Data Loss Prevention (DLP) policies in Microsoft 365 currently support only Windows 11 (and Windows 10) devices. Android and iOS devices are not supported for Endpoint DLP policy enforcement. While these platforms may have other data protection capabilities through app-based protections, true Endpoint DLP is limited to Windows endpoints.
Why the other options are wrong
- B. Android devices are not supported for Endpoint DLP policies.
- C. iOS devices are not supported for Endpoint DLP policies.
- D. Neither Android nor iOS devices are supported for Endpoint DLP policies.
Question 88
You have a Microsoft 365 E5 tenant. You create an auto-labeling policy to encrypt emails that contain a sensitive info type. You specify the locations where the policy will be applied. You need to deploy the policy. What should you do first?
Show answer and explanation
Correct answer: A. Run the policy in simulation mode.
Before deploying an auto-labeling policy in production, Microsoft best practice requires running the policy in simulation mode first. This allows you to test the policy and verify it correctly identifies and labels content according to your specifications before enabling it for actual enforcement, reducing the risk of unintended labeling or performance impacts.
Why the other options are wrong
- B. Azure Information Protection analytics configuration is not a prerequisite for deploying auto-labeling policies and does not need to occur first.
- C. Reviewing sensitive information in Activity Explorer is helpful for analysis but is not required before policy deployment.
- D. Turning on the policy immediately skips the necessary testing and validation phase that simulation mode provides.
Question 89
You have a Microsoft 365 subscription. Your company has a customer ID associated to each customer. The customer IDs contain 10 numbers followed by 10 characters. The following is a sample customer ID: 12-456-7890-abc-de-fghij. You plan to create a data loss prevention (DLP) policy that will detect messages containing customer IDs. What should you create to ensure that the DLP policy can detect the customer IDs?
Show answer and explanation
Correct answer: C. a sensitive information type
A sensitive information type is a pattern-based classifier used by DLP policies to detect specific data formats. Since the customer IDs follow a specific pattern (10 numbers followed by 10 characters in a defined format like 12-456-7890-abc-de-fghij), you must create a custom sensitive information type that defines this pattern so the DLP policy can recognize and detect these customer IDs in messages.
Why the other options are wrong
- A. PowerShell scripts are used for automation and configuration but cannot be directly used as detection patterns in DLP policies.
- B. Sensitivity labels are used for data classification and encryption, not for pattern detection in DLP policies.
- D. Retention labels manage how long items are kept, not for detecting specific data patterns in messages.
Question 90
You have a Microsoft E5 subscription. You need to ensure that administrators who need to manage Microsoft Exchange Online are assigned the Exchange Administrator role for five hours at a time. What should you implement?
Show answer and explanation
Correct answer: A. Azure AD Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) is the appropriate solution for assigning the Exchange Administrator role for five-hour durations. PIM enables just-in-time privileged access with configurable activation time limits, allowing administrators to request the Exchange Administrator role for specific durations rather than having permanent access.
Why the other options are wrong
- B. Conditional access policies manage access based on conditions but do not provide time-limited role assignment capabilities.
- C. Communication compliance policies are used for monitoring communications content, not for managing administrative role assignments.
- D. Azure AD Identity Protection detects and responds to identity risks but does not manage privileged role assignment with time limits.
- E. Dynamic membership groups automate group membership based on rules but do not provide time-limited role assignment functionality.
Question 91
You have a Microsoft 365 subscription. You configure a data loss prevention (DLP) policy. You discover that users are incorrectly marking content as false positive and bypassing the DLP policy. You need to prevent the users from bypassing the DLP policy. What should you configure?
Show answer and explanation
Correct answer: D. user overrides
User overrides in DLP policies control whether users can justify policy violations and bypass DLP blocks. By disabling user overrides, you prevent users from marking content as false positives and bypassing the policy themselves, ensuring that DLP restrictions are enforced without exception and only administrators can modify policy application.
Why the other options are wrong
- A. Actions define what DLP does (block, alert, etc.) but do not control whether users can override or bypass those actions.
- B. Incident reports generate notifications about policy violations but do not prevent users from bypassing the policy.
- C. Exceptions are preconfigured policy carve-outs controlled by administrators; they do not relate to preventing user-initiated false positive claims.
Question 92
Your company has 10,000 users who access all applications from an on-premises data center. You plan to create a Microsoft 365 subscription and to migrate data to the cloud. You plan to implement directory synchronization. User accounts and group accounts must sync to Azure AD successfully. You discover that several user accounts fail to sync to Azure AD. You need to resolve the issue as quickly as possible. What should you do?
Show answer and explanation
Correct answer: B. Run idfix.exe, and then click Edit.
IDFix is a directory synchronization error remediation tool designed to identify and fix object synchronization issues in on-premises Active Directory before they replicate to Azure AD. Running idfix.exe identifies problematic objects, and clicking Edit allows you to remediate the errors directly, which is the quickest way to resolve sync failures for multiple user accounts.
Why the other options are wrong
- A. Active Directory Administrative Center is for general AD administration, not for identifying sync-specific object attribute errors that prevent Azure AD synchronization.
- C. Running a delta sync cycle will not resolve the underlying object attribute problems causing sync failures; the errors must be fixed first.
- D. Clicking Complete in IDFix without using Edit means the errors are not actually remediated, only marked as processed, leaving the sync issues unresolved.
That was 92 of 460.
The full Microsoft MS-102 pack has all 460 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 230 free as one PDF by email. Get the Half Pack →