Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 201:

  HOTSPOT

  You have a Microsoft 365 subscription that uses a default domain named litwareinc.com. The subscription has a Microsoft SharePoint site collection named Collection1.

  From the Azure Active Directory admin center, you configure the External collaboration settings as shown in the External Collaboration Settings exhibit. (Click the External Collaboration Settings tab.)

  

  From the SharePoint admin center, you configure the sharing settings as shown in the SharePoint Sharing exhibit. (Click the SharePoint Sharing tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  In the first exhibit, “Allow invitations to be sent to any domain (most inclusive) is enabled”. Also, everyone is allowed to ‘invite’. The Target Domains setting will have no effect. This would only apply if one of the Allow/Deny invitations to the

  specified domain options were selected.

  There is a restriction that blocks invitations being sent to contoso.com. However, this restriction does not apply to Fabrikam.com. Therefore, you can share the files in Collection1 to [email protected].

  Box 2: Yes

  As noted above, external sharing is enabled for any domain except contoso.com. The Target Domains setting in the first exhibit will have no effect. Therefore, you can share Collection1 to [email protected].

  Box 3: Yes

  As noted above, external sharing is enabled for any domain except contoso.com. Blocking sharing to contoso.com does not block sharing to us.contoso.com. Therefore, you can share Collection1 to [email protected].

  Reference:

  https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off

• Question 202:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named contoso.com.

  Your company purchases a Microsoft 365 subscription and establishes a hybrid deployment of Azure Active Directory (Azure AD) by using password hash synchronization.

  You create a new user named User10 on-premises and a new user named User20 in Azure AD.

  You need to identify where an administrator can reset the password of each new user.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  If a user account is created in the on-premise Active Directory and synchronized to Azure Active Directory, you can reset the password of the user account in the on-premise Active Directory only. If a user account is created in Azure Active Directory, you can reset the password of the user account in the Azure Active Directory only.

• Question 203:

  HOTSPOT

  Your company has a Microsoft 365 subscription that contains the following domains: Contoso.onmicrosoft.com Contoso.com

  You plan to add the following domains to Microsoft 365 and to use them with Exchange Online:

  1.

  Sub1.contoso.onmicrosoft.com

  2.

  Sub2.contoso.com

  3.

  Fabrikam.com

  You need to identify the minimum number of DNS records that must be added for Exchange Online to receive inbound email messages for the three domains.

  How many DNS records should you add? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 2 You don't need to verify Sub1.contoso.onmicrosoft.com because the onmicrosoft.com domain and DNS is managed by Microsoft. You also don't need to configure an MX record for Sub1.contoso.onmicrosoft.com because that will be done by Microsoft.

  For sub2.contoso.com, you don't need to verify the domain because you have already verified its parent domain contoso.com. However, you do need an MX record to direct email for that domain to Exchange Online.

  For Fabrikam.com, you will need to verify the domain. You will need an MX record to direct email for that domain to Exchange Online.

  Box 2: 0 You ‘should’ create CNAME records for autodiscover to point your email clients to Exchange Online to connect to the mailboxes. However, you don't have to. You could configure the email client manually. Therefore, the minimum number of CNAME records required is zero.

• Question 204:

  HOTSPOT

  You company has a Microsoft 365 subscription that contains the domains shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Only the Contoso20198.onmicrosoft.com domain has a status of Setup Complete. The other two statuses mean that the domain setup is not complete or has issues that need to be corrected before they can be used.

  Reference: https://support.office.com/en-gb/article/what-do-domain-statuses-mean-in-office-365-3ecf1fef-3b31-497c-98bc-e57e2413b4e5

• Question 205:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named contoso.com that syncs to Azure Active Directory (Azure AD).

  You have users in contoso.com as shown in the following table.

  

  The users have the passwords shown in the following table.

  

  You implement password protection as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No User1's password contains the banned password ‘Contoso’. However, User1 will not be required to change his password at next sign in. When the password expires or when User1 (or an administrator) changes the password, the password will be evaluated and will have to meet the password requirements.

  Box 2: Yes Password evaluation goes through several steps including normalization and Substring matching which is used on the normalized password to check for the user's first and last name as well as the tenant name. Normalization is the process of converting common letter substitutes into letters. For example, 0 converts to o. $ converts to s. etc.

  The next step is to identify all instances of banned passwords in the user's normalized new password. Then:

  1.

  Each banned password that is found in a user's password is given one point.

  2.

  Each remaining unique character is given one point.

  3.

  A password must be at least five (5) points for it to be accepted.

  ‘C0nt0s0’ becomes ‘contoso’ after normalization. Therefore, C0nt0s0_C0mplex123 contains one instance of the banned password (contoso) so that equals 1 point. After ‘contoso’, there are 11 unique characters. Therefore, the score for

  ‘C0nt0s0_C0mplex123’ is 12. This is more than the required 5 points so the password is acceptable.

  Box 3:

  The ‘Password protection for Windows Server Active Directory’ is in ‘Audit’ mode. This means that the password protection rules are not applied. Audit mode is for logging policy violations before putting the password protection ‘live’ by

  changing the mode to ‘enforced’.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

• Question 206:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

  

  User1 is the owner of Group1. User2 is the owner of Group2.

  You create an access review that contains the following configurations:

  1.

  Users to review: Members of a group

  2.

  Scope: Everyone

  3.

  Group: Group1, Group2

  4.

  Reviewers: Group owners

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  User1 is the owner of Group1. User2 is in Group1 and Group2. Group owners can review access. Therefore, User1 can review User2's membership of Group1.

  Box 2: Yes

  User1 is the owner of Group1. User3 is in Group1 and Group2. Group owners can review access. Therefore, User1 can review User3's membership of Group1.

  Box 3: No

  Only group owners can review access. User3 is not a group owner. Therefore, User3 cannot review membership of the groups.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 207:

  HOTSPOT

  You need to ensure that a user named User1 can create documents by using Office Online.

  Which two Microsoft Office 365 license options should you turn on for User1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct section is worth one point.

  Hot Area:

  

  Correct Answer:

  

  You need “Office Online” to be able to create documents by using Office Online. You also need an online location to save and store the documents. For this, you would use SharePoint online.

• Question 208:

  HOTSPOT

  Your network contains an Active Directory domain named fabrikam.com. The domain contains the objects shown in the following table.

  

  The groups have the members shown in the following table.

  

  You are configuring synchronization between fabrikam.com and a Microsoft Azure Active Directory (Azure AD) tenant.

  You configure the Domain/OU Filtering settings in Azure AD Connect as shown in the Domain/OU Filtering exhibit. (Click the Domain/OU Filtering tab.)

  

  You configure the Filtering settings in Azure AD Connect as shown in the Filtering exhibit. (Click the Filtering tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  The filtering is configured to synchronize Group2 and OU2 only. The effect of this is that only members of Group2 who are in OU2 will be synchronized.

  User2 is in Group2. However, the User2 account object is in OU1 so User2 will not synchronize to Azure AD.

  Box 2: Yes

  Group2 is in OU2 so Group2 will synchronize to Azure AD. However, only members of the group who are in OU2 will synchronize. Members of Group2 who are in OU1 will not synchronize.

  Box 3: Yes

  User3 is in Group2 and in OU2. Therefore, User3 will synchronize to Azure AD.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#group-based-filtering

• Question 209:

  HOTSPOT

  Your network contains an on-premises Active Directory forest named contoso.com. The forest contains the users shown in the following table.

  

  You create an Azure Active Directory (Azure AD) tenant named fabrikam.onmicrosoft.com.

  You plan to sync the users in the forest to fabrikam.onmicrosoft.com by using Azure AD Connect.

  Which username will be assigned to User1 and User2 in Azure AD after the synchronization? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  If you added the contoso.com and east.contoso.com domains as custom domains in Microsoft 365, then the users would be assigned their user principle names as Microsoft 365 usernames. However, the question does not state that you have added the domains as custom domains. Therefore, both users will use the default @fabrikam.onmicrosoft.com domain for their usernames.

• Question 210:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD) by using the Azure AD Connect Express Settings. Password writeback is disabled.

  You create a user named User1 and enter Pass in the Password field as shown in the following exhibit.

  

  The Azure AD password policy is configured as shown in the following exhibit.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  The question states that User1 is synced to Azure AD. This tells us that the short password (Pass) meets the on-premise Active Directory password policy and you were able to create the on-premise account for User1. The on-premise

  Active Directory password policy applies over the Azure AD password policy for synced user accounts.

  Box 2: No

  Self-Service Password Reset would need to be configured.

  Box 3: Yes

  The password for the Azure AD User1 account will expire after 90 days according to the Azure AD password policy. If the on-premise password policy has a shorter password expiration period, User1 would have the change his/her on-

  premise AD password. The new password would then sync to Azure AD.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-express