Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 261:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory forest.

  You deploy Microsoft 365.

  You plan to implement directory synchronization.

  You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:

  1.

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.

  2.

  User passwords must be 10 characters or more.

  Solution: Implement password hash synchronization and modify the password settings from the Default Domain Policy in Active Directory.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  This solution meets the requirements:

  1.

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. (this is because the authentication is performed by Azure Active Directory).

  2.

  Users passwords must be 10 characters or more. (the Default Domain Policy in the on-premise Active Directory can be configured to require the password length)

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

• Question 262:

  Your company has a Microsoft 365 subscription that has multi-factor authentication configured for all users.

  Users that connect to Microsoft 365 services report that they are prompted for multi-factor authentication multiple times a day.

  You need to reduce the number of times the users are prompted for multi-factor authentication on their company-owned devices. Your solution must ensure that users are still prompted for MFA.

  What should you do?

  A. Enable the multi-factor authentication trusted IPs setting, and then verify each device as a trusted device.

  B. Enable the remember multi-factor authentication setting, and then verify each device as a trusted device.

  C. Enable the multi-factor authentication trusted IPs setting, and then join all client computers to Microsoft Azure Active Directory (Azure AD).

  D. Enable the remember multi-factor authentication setting, and then join all client computers to Microsoft Azure Active Directory (Azure AD).

  Correct Answer: B

  The remember Multi-Factor Authentication feature for devices and browsers that are trusted by the user is a free feature for all Multi-Factor Authentication users. Users can bypass subsequent verifications for a specified number of days, after they've successfully signed-in to a device by using Multi-Factor Authentication. The feature enhances usability by minimizing the number of times a user has to perform two-step verification on the same device.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings

• Question 263:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory forest.

  You deploy Microsoft 365.

  You plan to implement directory synchronization.

  You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:

  1.

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.

  2.

  User passwords must be 10 characters or more.

  Solution: Implement pass-through authentication and configure password protection in the Azure AD tenant.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  This solution does not meet the following requirement:

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.

  This is because with pass-through authentication, the authentication is performed by the on-premise Active Directory.

  This solution does not meet the following requirement:

  Users passwords must be 10 characters or more.

  To meet this requirement, you would need to configure the Default Domain Policy in the on-premise Active Directory.

  Azure Password Protection can prevent users from using passwords from a `banned password' list but it cannot be configured to require that passwords must be 10 characters or more.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

• Question 264:

  You have a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com.

  A temporary employee at your company uses an email address of [email protected].

  You need to ensure that the temporary employee can sign in to contoso.com by using the [email protected] account.

  What should you do?

  A. From the Azure Active Directory admin center, create a new user.

  B. From the Microsoft 365 admin center, create a new contact.

  C. From the Azure Active Directory admin center, create a new guest user.

  D. From the Microsoft 365 admin center, create a new user.

  Correct Answer: C

  You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest

  user must then redeem their invitation to access resources. An invitation of a user does not expire.

  The invitation will include a link to create a Microsoft account. The user can then authenticate using their Microsoft account. In this question, the external vendor already has a Microsoft account ([email protected]) so he can authenticate

  using that.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/b2b/add-users-administrator

• Question 265:

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains 10,000 users.

  The company has a Microsoft 365 subscription.

  You enable Azure Multi-Factor Authentication (MFA) for all the users in contoso.com.

  You run the following query.

  search "SigninLogs" | where ResultDescription == "User did not pass the MFA challenge."

  The query returns blank results.

  You need to ensure that the query returns the expected results.

  What should you do?

  A. From the Azure Active Directory admin center, configure the diagnostics settings to archive logs to an Azure Storage account.

  B. From the Security and Compliance admin center, turn on auditing.

  C. From the Security and Compliance admin center, enable Office 365 Analytics.

  D. From the Azure Active Directory admin center, configure the diagnostics settings to send logs to an Azure Log Analytics workplace.

  Correct Answer: D

  You can now send audit logs to Azure Log Analytics. This gives you much easier reporting on audit events and the ability to perform queries such as the one in this question.

  References: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics

• Question 266:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory forest.

  You deploy Microsoft 365.

  You plan to implement directory synchronization.

  You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:

  1.

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.

  2.

  User passwords must be 10 characters or more.

  Solution: Implement pass-through authentication and modify the password settings from the Default Domain Policy in Active Directory.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  This solution does not meet the following requirement:

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.

  This is because with pass-through authentication, the authentication is performed by the on-premise Active Directory.

  This solution does meet the following requirement:

  User passwords must be 10 characters or more.

  Configuring the Default Domain Policy in the on-premise Active Directory meets the requirement.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

• Question 267:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory forest.

  You deploy Microsoft 365.

  You plan to implement directory synchronization.

  You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements:

  1.

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable.

  2.

  User passwords must be 10 characters or more.

  Solution: Implement password hash synchronization and configure password protection in the Azure AD tenant.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  This solution meets the following requirement:

  Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. (this is because the authentication is performed by Azure Active Directory).

  This solution does not meet the following requirement:

  Users passwords must be 10 characters or more.

  To meet this requirement, you would need to configure the Default Domain Policy in the on-premise Active Directory.

  Azure Password Protection can prevent users from using passwords from a `banned password' list but it cannot be configured to require that passwords must be 10 characters or more.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

• Question 268:

  You have a Microsoft 365 subscription.

  Your company deploys an Active Directory Federation Services (AD FS) solution.

  You need to configure the environment to audit AD FS user authentication.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From all the AD FS servers, run auditpol.exe.

  B. From all the domain controllers, run the Set-AdminAuditLogConfig cmdlet and specify the -LogLevel parameter.

  C. On a domain controller, install Azure AD Connect Health for AD DS.

  D. From the Azure AD Connect server, run the Register-AzureADConnectHealthSyncAgent cmdlet.

  E. On an AD FS server, install Azure AD Connect Health for AD FS.

  Correct Answer: DE

  To audit AD FS user authentication, you need to install Azure AD Connect Health for AD FS. The agent should be installed on an AD FS server. After the installation, you need to register the agent by running the Register-AzureADConnectHealthSyncAgent cmdlet.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-agent-install https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-adfs

• Question 269:

  You have a Microsoft 365 Enterprise E5 subscription.

  You need to enforce multi-factor authentication on all cloud-based applications for the users in the finance department.

  What should you do?

  A. Create an activity policy.

  B. Create a new app registration.

  C. Create a conditional access policy.

  D. Create a session policy.

  Correct Answer: C

  You can configure a conditional access policy that applies to the Finance department users. The policy can be configured to `Allow access' but with multi-factor authentication as a requirement. The reference below explains how to create a

  conditional access policy that requires MFA for all users. To apply the policy to finance users only, you would select Users and Group in the Include section instead of All Users and then specify the finance department group.

  Note:

  There are several versions of this question in the exam. The question has two possible correct answers:

  1.

  Create a sign-in risk policy.

  2.

  Create a conditional access policy.

  Other incorrect answer options you may see on the exam include the following:

  1.

  Create an activity policy.

  2.

  Create a session policy.

  3.

  Create an app permission policy.

  4.

  Configure the sign-in status for the user accounts of the finance department users.

  5.

  Assign an Enterprise Mobility + Security E5 license to the finance department users.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

• Question 270:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company plans to deploy several Microsoft Office 365 services.

  You need to design an authentication strategy for the planned deployment. The solution must meet the following requirements:

  1.

  Users must be able to authenticate during business hours only.

  2.

  Authentication requests must be processed successfully if a single server fails.

  3.

  When the password for an on-premises user account expires, the new password must be enforced the next time the user signs in.

  4.

  Users who connect to Office 365 services from domain-joined devices that are connected to the internal network must be signed in automatically.

  Solution: You design an authentication strategy that uses password hash synchronization and seamless SSO. The solution contains two servers that have an Authentication Agent installed.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  This solution meets the following requirements:

  1.

  Users who connect to Office 365 services from domain-joined devices that are connected to the internal network must be signed in automatically.

  2.

  Authentication requests must be processed successfully if a single server fails.

  The following requirements are not met:

  1.

  Users must be able to authenticate during business hours only.

  2.

  When the password for an on-premises user account expires, the new password must be enforced the next time the user signs in.

  To meet these two requirements, you would have to configure pass-through authentication.

  Reference:

  https://docs.microsoft.com/en-us/azure/security/azure-ad-choose-authn