Microsoft Microsoft Certifications MS-102 Questions & Answers

• Question 111:

  You have a Microsoft 365 subscription that uses an Azure AD tenant named contoso.com. The tenant contains the users shown in the following table.

  

  You add another user named User5 to the User Administrator role.

  You need to identify which two management tasks User5 can perform.

  Which two tasks should you identify? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Delete User2 and User4 only.

  B. Reset the password of User4 only

  C. Reset the password of any user in Azure AD.

  D. Delete User1, User2, and User4 only.

  E. Reset the password of User2 and User4 only.

  F. Delete any user in Azure AD.

  Correct Answer: AE

  Users with the User Administrator role can create users and manage all aspects of users with some restrictions (see below).

  Only on users who are non-admins or in any of the following limited admin roles:

  Directory Readers

  Guest Inviter

  Helpdesk Administrator

  Message Center Reader

  Reports Reader

  User Administrator

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory- assign-admin-roles#available-roles

• Question 112:

  You have a Microsoft 365 E5 subscription.

  You create an account for a new security administrator named SecAdmin1.

  You need to ensure that SecAdmin1 can manage Office 365 Advanced Threat Protection (ATP) settings and policies for Microsoft Teams, SharePoint, and OneDrive.

  Solution: From the Azure Active Directory admin center, you assign SecAdmin1 the Security administrator role.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

• Question 113:

  You have an Azure AD tenant.

  You have 1,000 computers that run Windows 10 Pro and are joined to Azure AD.

  You purchase a Microsoft 365 E3 subscription.

  You need to deploy Windows 10 Enterprise to the computers. The solution must minimize administrative effort.

  What should you do?

  A. From the Microsoft Endpoinf Manager admin center, create a Windows Autopilot deployment profile. Assign the profile to all the computers. Instruct users to restart their computer and perform a network restart.

  B. Enroll the computers in Microsoft Intune. Create a configuration profile by using the Edition upgrade and mode switch template. From the Microsoft Endpoint Manager admin center, assign the profile to all the computers and instruct users to restart their computer.

  C. From Windows Configuration Designer, create a provisioning package that has an EditionUpgrade configuration and upload the package to a Microsoft SharePoint Online site. Instruct users to run the provisioning package from SharePoint Online.

  D. From the Azure Active Directory admin center, create a security group that has dynamic device membership. Assign licenses to the group and instruct users to sign in to their computer.

  Correct Answer: B

• Question 114:

  You have a Microsoft 365 E5 subscription that contains the groups shown in the following table.

  

  You plan to publish a sensitivity label named Label1.

  To which groups can you publish Label1?

  A. Group1 only

  B. Group1 and Group2 only

  C. Group1 and Group4 only

  D. Group1, Group2, and Group3 only

  E. Group1 Group2, Group3, and Group4

  Correct Answer: D

  The correct answer is D. You can apply sensitivity labels to Microsoft 365 Groups, SharePoint sites, Distribution Groups, and Mail-enabled Security Groups but not regular Security Groups. https://learn.microsoft.com/en-us/purview/sensitivity-labels#what-label-policies-can-do

• Question 115:

  You have a Microsoft 365 tenant that contains 1,000 iOS devices enrolled in Microsoft Intune. You plan to purchase volume-purchased apps and deploy the apps to the devices. You need to track used licenses and manage the apps by using Intune. What should you use to purchase the apps?

  A. Microsoft Store for Business

  B. Apple Business Manager

  C. Apple iTunes Store

  D. Apple Configurator

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/mem/intune/apps/vpp-apps-ios

• Question 116:

  You have a Microsoft 365 tenant that contains two users named User1 and User2. You create the alert policy shown in the following exhibit.

  

  User2 runs a script that modifies a file in a Microsoft SharePoint Online library once every four minutes and runs for a period of two hours. How many alerts will User1 receive?

  A. 2

  B. 5

  C. 10

  D. 25

  Correct Answer: A

  "When multiple events that match the conditions of an alert policy occur with a short period of time, they are added to an existing alert by a process called alert aggregation. When an event triggers an alert, the alert is generated and displayed on the Alerts page and a notification is sent. If the same event occurs within the aggregation interval, then Microsoft 365 adds details about the new event to the existing alert instead of triggering a new alert. The goal of alert aggregation is to help reduce alert "fatigue" and let you focus and take action on fewer alerts for the same event."

  https://learn.microsoft.com/en-us/purview/alert-policies?view=o365-worldwide#alert-aggregation

• Question 117:

  You have a Microsoft 365 E5 subscription.

  Users access Microsoft 365 from both their laptop and a corporate Virtual Desktop Infrastructure (VDI) solution.

  From Azure AD Identity Protection, you enable a sign-in risk policy.

  Users report that when they use the VDI solution, they are regularly blocked when they attempt to access Microsoft 365.

  What should you configure?

  A. the Tenant restrictions settings in Azure AD

  B. a trusted location

  C. a Conditional Access policy exclusion

  D. the Microsoft 365 network connectivity settings

  Correct Answer: B

  There are two types of risk policies in Azure Active Directory (Azure AD) Conditional Access you can set up to automate the response to risks and allow users to self-remediate when risk is detected:

  Sign-in risk policy

  User risk policy

  Configured trusted network locations are used by Identity Protection in some risk detections to reduce false positives.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity- protection-configure-risk-policies

  https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location- condition

• Question 118:

  You have a Microsoft 365 E5 tenant that has sensitivity label support enabled for Microsoft and SharePoint Online.

  You need to enable unified labeling for Microsoft 365 groups.

  Which cmdlet should you run?

  A. set-unifiedGroup

  B. Set-Labelpolicy

  C. Execute-AzureAdLebelSync

  D. Add-UnifiedGroupLinks

  Correct Answer: C

• Question 119:

  You have a Microsoft 365 E5 subscription.

  You need to identify which users accessed Microsoft Office 365 from anonymous IP addresses during the last seven days.

  What should you do?

  A. From the Cloud App Security admin center, select Users and accounts.

  B. From the Microsoft 365 security center, view the Threat tracker.

  C. From the Microsoft 365 admin center, view the Security and compliance report.

  D. From the Azure Active Directory admin center, view the Risky sign-ins report.

  Correct Answer: A

• Question 120:

  You have a Microsoft 365 subscription. You have a user named User1. You need to ensure that Used can place a hold on all mailbox content.

  What permission should you assign to User1?

  A. the Information Protection administrator ide from the Azure Active Directory admin center.

  B. the eDiscovery Manager tote from the Microsoft 365 compliance center.

  C. the Compliance Management role from the Exchange admin center.

  D. the User management administrator role from the Microsoft 365 admin center.

  Correct Answer: B