Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 191:

  HOTSPOT

  You have a Microsoft Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  You enable self-service password reset for all users. You set Number of methods required to reset to 1, and you set Methods available to users to Security questions only.

  What information must be configured for each user before the user can perform a self-service password reset? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Microsoft enforces a strong default two-gate password reset policy for any Azure administrator role. This policy may be different from the one you have defined for your users and cannot be changed. You should always test password reset

  functionality as a user without any Azure administrator roles assigned.

  With a two-gate policy, administrators don't have the ability to use security questions.

  The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number.

  User3 is not assigned to an Administrative role so the configured method of Security questions only applies to User3.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-password-policy-differences

• Question 192:

  HOTSPOT

  You have an Active Directory domain named Adatum.com that is synchronized to Azure Active Directory as shown in the exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Group Writeback is enabled in the Azure AD Connect configuration so groups created in Azure Active Directory will be synchronized to the on-premise Active Directory. A security group created in Azure Active Directory will be synchronized to the on-premise Active Directory as a security group. Device Writeback is enabled in the Azure AD Connect configuration so computers joined to the Azure Active Directory will be synchronized to the on-premise Active Directory. They will sync to the RegisteredDevices container in the onpremise Active Directory.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-device-writeback

• Question 193:

  HOTSPOT

  You have a Microsoft 365 subscription that contains the users shown in the following table.

  

  You have the named locations shown in the following table.

  

  You create a conditional access policy that has the following configurations:

  1.

  Users and groups:

  2.

  Include: Group1

  3.

  Exclude: Group2

  Cloud apps: Include all cloud apps

  1.

  Conditions:

  2.

  Include: Any location

  3.

  Exclude: Montreal

  Access control: Grant access, Require multi-factor authentication

  User1 is on the multi-factor authentication (MFA) blocked users list.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  The Blocked User list is used to block specific users from being able to receive Multi-Factor Authentication requests. Any authentication attempts for blocked users are automatically denied. Users remain blocked for 90 days from the time that they are blocked.

  Box 1: Yes

  133.107.10.20 is in the Montreal named location. The conditional access policy excludes Montreal so the policy does not apply. Therefore, User1 can access Microsoft Office 365.

  Box 2: No

  193.77.10.15 is in the Toronto named location. The conditional access policy applies to Group1 which User1 is a member of and all locations except for Montreal. Therefore, the conditional access policy applies in this case. The policy requires MFA but User1 is on the MFA blocked list so he is unable to use MFA. Therefore, User1 cannot access Microsoft 365.

  Box 3: Yes

  User2 is in Group1 and Group2. The conditional access policy applies to Group1 but excludes Group2. Therefore, the conditional access policy does not apply in this case so User2 can access Microsoft Office 365.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings

• Question 194:

  HOTSPOT

  Your network contains an Active Directory domain named fabrikam.com. The domain contains the objects shown in the following table.

  

  The groups have the members shown in the following table.

  

  You are configuring synchronization between fabrikam.com and a Microsoft Azure Active Directory (Azure AD) tenant.

  You configure the Domain/OU Filtering settings in Azure AD Connect as shown in the Domain/OU Filtering exhibit. (Click the Domain/OU Filtering tab.)

  

  You configure the Filtering settings in Azure AD Connect as shown in the Filtering exhibit. (Click the Filtering tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  The filtering is configured to synchronize Group2 and OU2 only. The effect of this is that only members of Group2 who are in OU2 will be synchronized.

  User2 is in Group2. However, the User2 account object is in OU1 so User2 will not synchronize to Azure AD.

  Box 2: Yes

  Group2 is in OU2 so Group2 will synchronize to Azure AD. However, only members of the group who are in OU2 will synchronize. Members of Group2 who are in OU1 will not synchronize.

  Box 3: Yes

  User3 is in Group2 and in OU2. Therefore, User3 will synchronize to Azure AD.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#group-based-filtering

• Question 195:

  HOTSPOT

  You are confirming an enterprise application named Test App in Microsoft Azur as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 196:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named contoso.com.

  Your company purchases a Microsoft 365 subscription and establishes a hybrid deployment of Azure Active Directory (Azure AD) by using password hash synchronization. Device writeback is disabled in Azure AD Connect.

  You create a new user named User10 on-premises and a new user named User20 in Azure AD.

  You need to identify where an administrator can reset the password of each new user.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  If a user account is created in the on-premise Active Directory and synchronized to Azure Active Directory, you can reset the password of the user account in the on-premise Active Directory only. If a user account is created in Azure Active Directory, you can reset the password of the user account in the Azure Active Directory only.

• Question 197:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table. User1 is the owner of Group1, User2 is the owner of Group2.

  You create an access review that contains the following configurations:

  1.

  Users to review, Member of a group

  2.

  Scope Everyone

  3.

  Group: Group1 and Group2

  4.

  Review Group owners

  For each of the following statements, select Yes if the statement is true. Otherwise select No. NOTE: Each correct selection is worth one point

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  User1 is the owner of Group1. User2 is in Group1 and Group2. Group owners can review access. Therefore, User1 can review User2's membership of Group1.

  Box 2: Yes

  User1 is the owner of Group1. User3 is in Group1 and Group2. Group owners can review access. Therefore, User1 can review User3's membership of Group1.

  Box 3: No

  Only group owners can review access. User3 is not a group owner. Therefore, User3 cannot review membership of the groups.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 198:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named contoso.com.

  Your company purchases a Microsoft 365 subscription and establishes a hybrid deployment of Azure Active Directory (Azure AD) by using password hash synchronization. Device writeback is disabled in Azure AD Connect.

  You create a new user named User10 on-premises and a new user named User20 in Azure AD.

  You need to identify where an administrator can reset the password of each new user.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  If a user account is created in the on-premise Active Directory and synchronized to Azure Active Directory, you can reset the password of the user account in the on-premise Active Directory only. If a user account is created in Azure Active Directory, you can reset the password of the user account in the Azure Active Directory only.

• Question 199:

  HOTSPOT

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com and a Microsoft 365 subscription.

  Contoso.com contains the users shown in the following table.

  

  You add an enterprise application named App1 to contoso.com.

  You configure the following self-service settings for App1:

  Allow users to request access to this application is set to Yes.

  To which group should assigned users be added is set to Group1.

  Who is allowed to approve access to this application is set to User2.

  Require approval before granting access to this application is set to Yes.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes.

  User1 can request access to App1 because “Allow users to request access to this application” is set to Yes.

  Box 2: No.

  User2 is an approver. If User2 requests access to App1, he will still need to approve the request before he is added to Group1.

  Box 3: Yes.

  User2 can approve requests for App1 because “Who is allowed to approve access to this application” is set to User2.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-self-service-access

• Question 200:

  HOTSPOT

  You need to meet the application requirement for the Office 365 ProPlus applications. You create a XML file that contains the following settings.

  Use the drop-down menus to select the choice that complete each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: