Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 11:

  HOTSPOT

  You need to meet the technical requirements for the user licenses.

  Which two properties should you configure for each user? To answer, select the appropriate properties in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  All new users must be assigned Office 365 licenses automatically.

  To enable Microsoft 365 license assignment, the users must have a username. This is also the UPN. The users must also have a Usage Location.

• Question 12:

  HOTSPOT

  You need to modify the HRApp manifest to provide a tab that supports querying the third- party HR system.

  Which section of the manifest should you modify, and which value should you set as the scope? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 13:

  HOTSPOT

  You need to meet the security requirements for User3. The solution must meet the technical requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1.

  User3 must be able to manage Office 365 connectors.

  2.

  The principle of least privilege must be used whenever possible.

  Office 365 connectors are configured in the Exchange Admin Center.

  You need to assign User3 the Organization Management role to enable User3 to manage Office 365 connectors.

  A Global Admin could manage Office 365 connectors but the Organization Management role has less privilege.

  Reference:

  https://docs.microsoft.com/en-us/office365/SecurityCompliance/eop/feature-permissions-in-eop

• Question 14:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  Currently, users cannot install Microsoft 365 Apps for enterprise from the Microsoft Office portal.

  You need to perform the following tasks:

  1.

  Enable the installation of Microsoft 365 Apps for enterprise from the Office portal.

  2.

  Ensure that the users can auto-claim Microsoft Teams licenses.

  Which two Org settings should you configure in the Microsoft 365 admin center? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Office installation options

  Enable the installation of Microsoft 365 Apps for enterprise from the Office portal.

  Manage Office installation options in the Microsoft 365 admin center

  As a Microsoft 365 admin, you can choose to do the following tasks on the Office installation options page in the Microsoft 365 admin center:

  Choose how often to get feature updates for Office

  Manage which version of Office is installed, including

  Roll back to a previous version

  Skip an upcoming version

  Choose whether users can install Office on their own devices

  Box 2: User owned apps and services

  Ensure that the users can auto-claim Microsoft Teams licenses.

  Change the assigning apps and services

  Each product has a collection of apps and services associated with it. For each product in your auto-claim policy, you can specify which apps and services to include when a user is automatically assigned a license to that product.

  1.

  In the admin center, go to the Billing > Licenses page, then select the Auto-claim policy tab.

  2.

  Select the policy that you want to edit.

  3.

  In the details pane, under Apps and services, select Edit.

  4.

  In the Apps and services pane, from the Product drop-down, select a single product, or select All products.

  5.

  Check or clear the boxes for apps and services that you want users to have or not have access to.

  6.

  When you're finished, select Save, then close the details pane.

  Reference: https://docs.microsoft.com/en-us/deployoffice/manage-software-download-settings-office-365

  https://docs.microsoft.com/en-us/microsoft-365/commerce/licenses/manage-auto-claim-policies

• Question 15:

  HOTSPOT

  You have a hybrid Microsoft Exchange Online deployment that contains the users shown in the following table.

  

  Mailbox permissions are assigned as shown in the following table.

  

  You plan to migrate the mailboxes to Exchange Online by using remote mailbox move requests. The mailboxes will be migrated in batches as shown in the following table.

  

  A cutover migration will be performed for each batch of mailboxes.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 16:

  HOTSPOT

  You have an Azure AD tenant named contoso.com that contains an enterprise app named App1 and two users named User1 and User2.

  You need to ensure that each user can perform the following action:

  1.

  User1: Create entitlement management access packages to provide external users with access to App1.

  2.

  User2: Create an access review for App1.

  The solution must use the principle of least privilege.

  Which role should you assign to each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: External Identity Provider Administrator

  User1: Create entitlement management access packages to provide external users with access to App1.

  External Identity Provider Administrator

  This administrator manages federation between Azure AD organizations and external identity providers. With this role, users can add new identity providers and configure all available settings (e.g. authentication path, service ID, assigned key

  containers). This user can enable the Azure AD organization to trust authentications from external identity providers.

  Incorrect:

  * User Administrator can manage access reviews for access package assignments in entitlement management

  Box 2: Identity Governance Administrator User2: Create an access review for Appl.

  Identity Governance Administrator can manage access reviews for access package assignments in entitlement management,

  Note: Identity Governance Administrator Users with this role can manage Azure AD identity governance configuration, including access packages, access reviews, catalogs and policies, ensuring access is approved and reviewed and guest users who no longer need access are removed.

  Incorrect:

  *

  Cloud App Security Administrator

  Users with this role have full permissions in Defender for Cloud Apps. They can add administrators, add Microsoft Defender for Cloud Apps policies and settings, upload logs, and perform governance actions.

  *

  Cloud Application Administrator

  Users in this role have the same permissions as the Application Administrator role, excluding the ability to manage application proxy. This role grants the ability to create and manage all aspects of enterprise applications and application

  registrations. Users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

  This role also grants the ability to consent for delegated permissions and application permissions, with the exception of application permissions for Microsoft Graph.

  *

  User Administrator Users with this role can create users, and manage all aspects of users with some restrictions (see the table), and can update password expiration policies. Additionally, users with this role can create and manage all groups. This role also includes the ability to create and manage user views, manage support tickets, and monitor service health. User Administrators don't have permission to manage some user properties for users in most administrator roles. Admins with this role do not have permissions to manage MFA or manage shared mailboxes.

  User Administrator can create access reviews for membership in Security and Microsoft 365 groups.

  *

  Privileged Role Administrator is not an option here.

  Users with this role can manage role assignments in Azure Active Directory, as well as within Azure AD Privileged Identity Management. They can create and manage groups that can be assigned to Azure AD roles. In addition, this role allows

  management of all aspects of Privileged Identity Management and administrative units.

  Privileged Role Administrator can create access reviews for membership in groups that are assignable to Azure AD roles

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 17:

  HOTSPOT

  You have a Microsoft 365 E5 subscription linked to an Azure AD tenant named contoso.com. The tenant contains a user named User1 and a Microsoft Teams team named Team1.

  The External collaboration settings in Azure AD are configured as shown in the following exhibit.

  

  You turn on guest access in Microsoft Teams.

  The External access settings in Microsoft Teams are configured as shown in the following exhibit.

  

  The Content sharing settings in Microsoft Teams are configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  Screen sharing mode is set to Entire screen.

  Box 2: Yes

  Allow only specific externals domains, Allowed domains includes europe.adatum.com

  Box 3: No

• Question 18:

  HOTSPOT

  You have a Microsoft 365 subscription that uses Microsoft Power Platform and contains production and sandbox environments.

  You discover that a sandbox environment is marked as Inactive.

  You need to identify the following:

  1.

  How many days before disabling the sandbox environment will administrators first be notified?

  2.

  What can you do to reactivate the environment?

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/power-platform/admin/automatic-environment-cleanup https://docs.microsoft.com/en-us/power-platform/admin/recover-environment

• Question 19:

  HOTSPOT

  You have an Azure AD tenant that contains the groups shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Group1 and Group3 only.

  Not Group2 as it is no security enabled.

  Not Group4 as it is dynamic.

  Not Group5 as it is a Windows server AD group.

  Box 2: Group3 only

  Not Group1 as it is a Windows 365 group.

  Note:

  Group types:

  Security. Used to manage member and computer access to shared resources for a group of users. For example, you can create a security group for a specific security policy. By doing it this way, you can give a set of permissions to all the

  members at once, instead of having to add permissions to each member individually. A security group can have users, devices, groups and service principals as its members and users and service principals as its owners.

  Microsoft 365. Provides collaboration opportunities by giving members access to a shared mailbox, calendar, files, SharePoint site, and more. This option also lets you give people outside of your organization access to the group. A Microsoft

  365 group can have only users as its members.

  Membership types:

  Assigned. Let's you add specific users to be members of this group and to have unique permissions.

  Dynamic user. Let's you use dynamic membership rules to automatically add and remove members. If a member's attributes change, the system looks at your directory's dynamic group rules to see if the member meets the rule requirements

  (is added) or no longer meets the rules requirements (is removed).

  Security: Security groups define who can access resources, and are recommended for your groups in Intune.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal

• Question 20:

  HOTSPOT

  You have a Microsoft 365 E5 subscription and an Azure AD tenant named contoso.com.

  All users have computers that run Windows 11, are joined to contoso.com, and are protected by using BitLocker Drive Encryption (BitLocker).

  You plan to create a user named Admin1 that will perform following tasks:

  1.

  View BitLocker recovery keys.

  2.

  Configure the usage location for the users in contoso.com.

  You need to assign roles to Admin1 to meet the requirements. The solution must use the principle of least privilege.

  Which two roles should you assign? To answer, select the appropriate roles in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Helpdesk Administrator View BitLocker recovery keys.

  The Helpdesk Administrator can read bitlocker metadata and key on devices.

  Box 2: License Administrator

  Configure the usage location for the users in contoso.com.

  A License Administrator can update usage location of users.

  Users in this role can add, remove, and update license assignments on users, groups (using group-based licensing), and manage the usage location on users. The role does not grant the ability to purchase or manage subscriptions, create or

  manage groups, or create or manage users beyond the usage location. This role has no access to view, create, or manage support tickets.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#helpdesk-administrator

  https://techcommunity.microsoft.com/t5/microsoft-intune/what-admin-role-grans-permission-to-view-devices-bitlocker/m-p/1587597