Microsoft Microsoft Certifications MS-100 Questions & Answers

• Question 421:

  You have a Microsoft 365 subscription.

  You plan to implement Microsoft Purview Privileged Access Management.

  Which Microsoft Office 365 workloads support privileged access?

  A. Microsoft Teams and SharePoint Online only

  B. Microsoft Teams, Exchange Online, and SharePoint Online

  C. Microsoft Exchange Online and SharePoint Online only

  D. Microsoft Exchange Online only

  E. Microsoft Teams only

  Correct Answer: D

  Privileged access management Having standing access by some users to sensitive information or critical network configuration settings in Microsoft Exchange Online is a potential pathway for compromised accounts or internal threat activities. Microsoft Purview Privileged Access Management helps protect your organization from breaches and helps to meet compliance best practices by limiting standing access to sensitive data or access to critical configuration settings. Instead of administrators having constant access, just-in-time access rules are implemented for tasks that need elevated permissions. Enabling privileged access management for Exchange Online in Microsoft 365 allows your organization to operate with zero standing privileges and provide a layer of defense against standing administrative access vulnerabilities.

  Note: When will privileged access support Office 365 workloads beyond Exchange? Privileged access management will be available in other Office 365 workloads soon.

  Reference: https://learn.microsoft.com/en-us/microsoft-365/compliance/privileged-access-management-solution-overview https://learn.microsoft.com/en-us/microsoft-365/compliance/privileged-access-management

• Question 422:

  You have Microsoft 365 E5 subscription that contains the groups shown in the following exhibit.

  

  You need to create an access review.

  For which groups can you create the access review?

  A. Group1 and Group2 only

  B. Group3 and Group4 only

  C. Group1, Group2, and Group3 only

  D. Group1, Group2, Group3, and Group5 only

  E. Group1, Group2, Group3, Group4, and Group5

  Correct Answer: C

  You can setup Access Review for Microsoft 365 Groups and for Security groups.

  Incorrect:

  Group 4: Not possible for Dynamic groups.

  Group 5: Not possible for Active Directory Groups.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 423:

  You have a Microsoft 365 E5 subscription that uses Endpoint security.

  You need to create a group and assign the Endpoint Security Manager role to the group.

  Which type of group can you use?

  A. security only

  B. mail-enabled security, Microsoft 365, and security only

  C. distribution, mail-enabled security, Microsoft 365, and security

  D. Microsoft 365 only

  E. mail-enabled security and security only

  Correct Answer: D

• Question 424:

  You have a Microsoft 365 E5 subscription that contains a group named Group1.

  You need to ensure that all the members of Group1 are notified when Microsoft 365 outages occur. The solution must minimize administrative effort.

  What should you do?

  A. From the Microsoft 365 admin center, configure a Service health email notification.

  B. From the Microsoft 365 admin center, configure a Message center email notification.

  C. From the Microsoft 365 Defender portal, create an alert policy and configure an email notification.

  D. From the Exchange admin center, create an alert policy and configure an email notification.

  Correct Answer: C

• Question 425:

  You have a Microsoft 365 E5 subscription that has multiple Conditional Access policies.

  You plan to deploy a dashboard that will display the impact of the policies on user sign-ins.

  You need to enable the Conditional Access insights and reporting workbook.

  What should you do first?

  A. Create a Log Analytics workspace.

  B. Create a workspace in Microsoft Power BI.

  C. Enable Microsoft 365 usage analytics.

  D. Enable audit logging in Microsoft 365.

  Correct Answer: A

  Prerequisites

  To enable the insights and reporting workbook, your tenant must have a Log Analytics workspace to retain sign-in logs data. Users must have Azure AD Premium P1 or P2 licenses to use Conditional Access.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting

• Question 426:

  Your company has a single Microsoft 365 E5 subscription.

  The company has five departments that each has a dedicated helpdesk operator.

  You need to ensure that the helpdesk operators can manage only the users in their respective department.

  What should you use?

  A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

  B. Custom role based access control (RBAC) roles

  C. Administrative units in Azure Active Directory (Azure AD)

  D. Privileged access management for Azure Active Directory (Azure AD)

  Correct Answer: B

• Question 427:

  Your on-premises network contains an Active Directory domain.

  You have a Microsoft 365 subscription.

  You need to sync the domain with the subscription. The solution must meet the following requirements:

  1.

  On-premises Active Directory password complexity policies must be enforced.

  2.

  Users must be able to use self-service password reset (SSPR) in Azure AD. What should you use?

  A. Azure AD Seamless Single Sign-On (Azure AD Seamless SSO)

  B. pass-through authentication

  C. password hash synchronization

  D. Azure AD Identity Protection

  Correct Answer: B

  Azure Active Directory (Azure AD) Pass-through Authentication allows your users to sign in to both on-premises and cloud-based applications using the same passwords.

  This feature is an alternative to Azure AD Password Hash Synchronization, which provides the same benefit of cloud authentication to organizations. However, certain organizations wanting to enforce their on-premises Active Directory

  security and password policies, can choose to use Pass-through Authentication instead.

  Note: Azure Active Directory (Azure AD) self-service password reset (SSPR) lets users reset their passwords in the cloud, but most companies also have an on-premises Active Directory Domain Services (AD DS) environment for users.

  Password writeback allows password changes in the cloud to be written back to an on-premises directory in real time by using either Azure AD Connect or Azure AD Connect cloud sync. When users change or reset their passwords using

  SSPR in the cloud, the updated passwords also written back to the on-premises AD DS environment.

  Password writeback is supported in environments that use the following hybrid identity models:

  Password hash synchronization

  Pass-through authentication Active Directory Federation Services

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback

• Question 428:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  From the Microsoft 365 Apps admin center, you create a deployment configuration.

  Which users can download the deployment configuration file from the Microsoft 365 Apps admin center?

  A. Admin2 only

  B. Admin2 and Admin3 only

  C. Admin2 and Admin4 only

  D. Admin1, Admin2, and Admin4 only

  E. Admin1, Admin2, Admin3, and Admin4

  Correct Answer: C

  How to get to the admin center

  Sign in at config.office.com with your admin account. To sign into the admin center, your account must have either the global administrator, security administrator (Admin4), or Office apps administrator (Admin2) role.

  Reference: https://docs.microsoft.com/en-us/deployoffice/admincenter/overview

• Question 429:

  You have a Microsoft 365 subscription that uses Microsoft Teams.

  You plan to enable guest user access in Teams.

  You need to limit the organization information of users in the subscription that can be viewed by the guest users.

  What admin center should you use?

  A. the Exchange

  B. the Microsoft Teams

  C. the Azure Active Directory

  D. the Microsoft 365

  Correct Answer: B

  Configure guest access in the Teams admin center

  1.

  Sign in to the Microsoft Teams admin center.

  2.

  Select Users > Guest access.

  3.

  Set Allow guest access in Teams to On.

  4.

  Under Calling, Meeting, and Messaging, select On or Off for each capability, depending on what you want to allow for guests.

  Make private calls - Turn this setting On to allow guests to make peer-to-peer calls. IP video - Turn this setting On to allow guests to use video in their calls and meetings. Screen sharing mode

  Etc.

  Reference: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests

• Question 430:

  You have a Microsoft 365 tenant that contains a Microsoft Power Platform production environment named Environment1.

  Environment1 contains a database and a Microsoft Dynamics 365 app.

  A system backup of Environment1 is performed on June 1.

  How many days will the system backup of Environment1 be retained?

  A. 5

  B. 7

  C. 14

  D. 28

  Correct Answer: D