Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 311:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain.

  You deploy a Microsoft Azure Active Directory (Azure AD) tenant.

  Another administrator configures the domain to synchronize to Azure AD.

  You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully.

  You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully.

  You need to ensure that the 10 user accounts are synchronized to Azure AD.

  Solution: From Azure AD Connect, you modify the Azure AD credentials.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The question states that "all the user account synchronizations completed successfully". Therefore, the Azure AD credentials are configured correctly in Azure AD Connect. It is likely that the 10 user accounts are being excluded from the synchronization cycle by a filtering rule.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

• Question 312:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain.

  You deploy a Microsoft Azure Active Directory (Azure AD) tenant.

  Another administrator configures the domain to synchronize to Azure AD.

  You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully.

  You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully.

  You need to ensure that the 10 user accounts are synchronized to Azure AD.

  Solution: From the Synchronization Rules Editor, you create a new outbound synchronization rule.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The question states that "all the user account synchronizations completed successfully". Therefore, the synchronization rule is configured correctly. It is likely that the 10 user accounts are being excluded from the synchronization cycle by a filtering rule.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

• Question 313:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your network contains an Active Directory domain.

  You deploy a Microsoft Azure Active Directory (Azure AD) tenant.

  Another administrator configures the domain to synchronize to Azure AD.

  You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully.

  You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully.

  You need to ensure that the 10 user accounts are synchronized to Azure AD.

  Solution: You run idfix.exe and export the 10 user accounts.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The question states that "all the user account synchronizations completed successfully". If there were problems with the 10 accounts that needed fixing with idfix.exe, there would have been synchronization errors in Azure AD Connect Health. It is likely that the 10 user accounts are being excluded from the synchronization cycle by a filtering rule.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering

• Question 314:

  Your company has a Microsoft 365 E5 subscription.

  Users in the research department work with sensitive data.

  You need to prevent the research department users from accessing potentially unsafe websites by using hyperlinks embedded in email messages and documents. Users in other departments must not be restricted.

  What should you do from the Security and Compliance admin center?

  A. Create a data loss prevention (DLP) policy that has a Content contains condition.

  B. Create a data loss prevention (DLP) policy that has a Content is shared condition.

  C. Modify the default safe links policy.

  D. Create a new safe links policy.

  Correct Answer: D

  ATP Safe Links, a feature of Office 365 Advanced Threat Protection (ATP), can help protect your organization from malicious links used in phishing and other attacks. If you have the necessary permissions for the Office 365 Security and Compliance Center, you can set up ATP Safe Links policies to help ensure that when people click web addresses (URLs), your organization is protected. Your ATP Safe Links policies can be configured to scan URLs in email and URLs in Office documents.

  Reference: https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-atp-safe-links-policies#policies-that-apply-to-specific-email-recipients

• Question 315:

  A user receives the following message when attempting to sign in to https://myapps.microsoft.com:

  "Your sign-in was blocked. We've detected something unusual about this sign-in. For example, you might be signing in from a new location, device, or app. Before you can continue, we need to verify your identity. Please contact your admin."

  Which configuration prevents the users from signing in?

  A. Security and Compliance supervision policies

  B. Security and Compliance data loss prevention (DLP) policies

  C. Microsoft Azure Active Directory (Azure AD) conditional access policies

  D. Microsoft Azure Active Directory (Azure AD) Identity Protection policies

  Correct Answer: C

  The user is being blocked due to a `risky sign-in'. This can be caused by the user logging in from a device that hasn't been used to sign in before or from an unknown location. Integration with Azure AD Identity Protection allows Conditional Access policies to identify risky sign-in behavior. Policies can then force users to perform password changes or multi-factor authentication to reduce their risk level or be blocked from access until an administrator takes manual action.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

• Question 316:

  You have a Microsoft 365 subscription that contains a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.

  In the tenant, you create a user named User1.

  You need to ensure that User1 can publish retention labels from the Security and Compliance admin center. The solution must use the principle of least privilege.

  To which role group should you add User1?

  A. Security Administrator

  B. Records Management

  C. Compliance Administrator

  D. eDiscovery Manager

  Correct Answer: C

  Members of your compliance team who will create retention labels need permissions to the Security and Compliance Center. By default, your tenant admin has access to this location and can give compliance officers and other people access to the Security and Compliance Center, without giving them all of the permissions of a tenant admin. To do this, we recommend that you go to the Permissions page of the Security and Compliance Center, edit the Compliance Administrator role group, and add members to that role group.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/labels#permissions

• Question 317:

  You have a Microsoft 365 subscription. You have a user named User1. You need to ensure that User1 can place a hold on all mailbox content. What permission should you assign to User1?

  A. the User management administrator role from the Microsoft 365 admin center

  B. the eDiscovery Manager role from the Security and Compliance admin center

  C. the Information Protection administrator role from the Azure Active Directory admin center

  D. the Compliance Management role from the Exchange admin center

  Correct Answer: B

  To create a query-based In-Place Hold, a user requires both the Mailbox Search and Legal Hold roles to be assigned directly or via membership in a role group that has both roles assigned. To create an In-Place Hold without using a query, which places all mailbox items on hold, you must have the Legal Hold role assigned. The Discovery Management role group is assigned both roles.

  Reference: https://docs.microsoft.com/en-us/Exchange/permissions/feature-permissions/policy-and-compliance-permissions?view=exchserver-2019

• Question 318:

  Your company has a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com.

  You sign up for Microsoft Store for Business.

  The tenant contains the users shown in the following table.

  

  Microsoft Store for Business has the following Shopping behavior settings:

  1.

  Allow users to shop is set to On.

  2.

  Make everyone a Basic Purchaser is set to Off.

  You need to identify which users can install apps from the Microsoft for Business private store.

  Which users should you identify?

  A. A. user1, User2, User3, User4, and User5

  B. User1 only

  C. User1 and User2 only

  D. User3 and User4 only

  E. User1, User2, User3, and User4 only

  Correct Answer: C

  Allow users to shop controls the shopping experience in Microsoft Store for Education. When this setting is on, Purchasers and Basic Purchasers can purchase products and services from Microsoft Store for Education.

  Reference: https://docs.microsoft.com/en-us/microsoft-store/acquire-apps-microsoft-store-for-business

• Question 319:

  You have a Microsoft 365 subscription.

  You plan to enable Microsoft Azure Information Protection.

  You need to ensure that only the members of a group named PilotUsers can protect content.

  What should you do?

  A. Run the Add-AadrmRoleBaseAdministrator cmdlet.

  B. Create an Azure Information Protection policy.

  C. Configure the protection activation status for Azure Information Protection.

  D. Run the Set-AadrmOnboardingControlPolicy cmdlet.

  Correct Answer: D

  If you don't want all users to be able to protect documents and emails immediately by using Azure Rights Management, you can configure user onboarding controls by using the Set-AadrmOnboardingControlPolicy

  Reference: https://docs.microsoft.com/en-us/azure/information-protection/activate-service

• Question 320:

  Your company has a Microsoft 365 subscription.

  You need to identify which users performed the following privileged administration tasks:

  1.

  Deleted a folder from the second-stage Recycle Bin if Microsoft SharePoint

  2.

  Opened a mailbox of which the user was not the owner

  3.

  Reset a user password What should you use?

  A. Microsoft Azure Active Directory (Azure AD) audit logs

  B. Microsoft Azure Active Directory (Azure AD) sign-ins

  C. Security and Compliance content search

  D. Security and Compliance audit log search

  Correct Answer: A

  You can view the required information in the audit logs. The Azure AD audit logs provide records of system activities for compliance. To access the audit report, select Audit logs in the Activity section of Azure Active Directory.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs