Microsoft Microsoft Certifications MS-102 Questions & Answers

• Question 11:

  You have a Microsoft 365 E5 subscription.

  You create a Conditional Access policy that blocks access to an app named App1 when users trigger a high-risk sign-in event.

  You need to reduce false positives for impossible travel when the users sign in from the corporate network.

  What should you configure?

  A. exclusion groups

  B. multi-factor authentication (MFA)

  C. named locations

  D. user risk policies

  Correct Answer: C

• Question 12:

  You have a Microsoft 365 subscription that contains the users shown in the following table.

  

  You plan to use Exchange Online to manage email for a DNS domain.

  An administrator adds the DNS domain to the subscription.

  The DNS domain has a status of Incomplete setup.

  You need to identify which user can complete the setup of the DNS domain. The solution must use the principle of least privilege.

  Which user should you identify?

  A. User1

  B. User2

  C. User3

  D. User4

  Correct Answer: A

• Question 13:

  You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint site named site1. You need to ensure that site1 meets the following requirements:

  Retains all data for 10 years Prevents the sharing of data outside the organization Which two items should you create and apply to site1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. a retention policy

  B. a sensitive info type

  C. a data loss prevention (DLP) policy

  D. a sensitivity label

  E. a retention label

  F. a retention label policy

  Correct Answer: AC

• Question 14:

  You are testing a data loss prevention (DLP) policy to protect the sharing of credit card information with external users.

  During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint.

  You need to prevent the user from sharing the credit card information by using email and SharePoint.

  What should you configure?

  A. the status of the DLP policy

  B. the user overrides of the DLP policy rule

  C. the locations of the DLP policy

  D. the conditions of the DLP policy rule

  Correct Answer: C

• Question 15:

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains 1,000 Windows 10 devices.

  You perform a proof of concept (PoC) deployment of Microsoft Defender for Endpoint for 10 test devices. During the onboarding process, you configure Microsoft Defender for Endpoint-related data to be stored in the United States.

  You plan to onboard all the devices to Microsoft Defender for Endpoint.

  You need to store the Microsoft Defender for Endpoint data in Europe.

  What should you do first?

  A. Delete the workspace.

  B. Create a workspace.

  C. Onboard a new device.

  D. Offboard the test devices.

  Correct Answer: D

  D. Offboard the test devices

  Offboarding the test devices as a first step, followed by setting up/creating a new workspace in Europe. If the data storage location is tied to the workspace and cannot be changed once set, then it would make sense to offboard the test devices from the current workspace before creating a new workspace in the data storage location of Europe.

• Question 16:

  You have a Microsoft 365 E5 tenant that uses Microsoft Intune. You need to ensure that users can select a department when they enroll their device in Intune. What should you create?

  A. scope tags

  B. device configuration profiles

  C. device categories

  D. device compliance policies

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/mem/intune/enrollment/device-group-mapping

• Question 17:

  You have a Microsoft 365 subscription that contains a user named User1.

  User1 requires admin access to perform the following tasks:

  Manage Microsoft Exchange Online settings.

  Create Microsoft 365 groups.

  You need to ensure that User1 only has admin access for eight hours and requires approval before the role assignment takes place.

  What should you use?

  A. zure AD Identity Protection

  B. Microsoft Entra Verified ID

  C. Conditional Access

  D. Azure AD Privileged Identity Management (PJM)

  Correct Answer: D

  Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:

  Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator and Privileged Role Administrator role assignments.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity- management/pim-configure

• Question 18:

  You have a Microsoft 365 E5 tenant that contains 500 Windows 10 devices. The devices are enrolled in Microsoft intune.

  You plan to use Endpoint analytics to identify hardware issues.

  You need to enable Window health monitoring on the devices to support Endpoint analytics

  What should you do?

  A. Configure the Endpoint analytics baseline regression threshold.

  B. Create a configuration profile.

  C. Create a Windows 10 Security Baseline profile

  D. Create a compliance policy.

  Correct Answer: B

• Question 19:

  You have a Microsoft 365 E5 subscription.

  From the Microsoft 365 Defender portal, you plan to export a detailed report of compromised users.

  What is the longest time range that can be included in the report?

  A. 1 day

  B. 7 days

  C. 30 days

  D. 90 days

  Correct Answer: C

  View email security reports in the Microsoft 365 Defender portal The aggregate view shows data for the last 90 days and the detail view shows data for the last 30 days Reference: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/reports-email- security

• Question 20:

  You have a Microsoft 365 tenant that contains a Windows 10 device. The device is onboarded to Microsoft Defender for Endpoint.

  From Microsoft Defender Security Center, you perform a security investigation.

  You need to run a PowerShell script on the device to collect forensic information.

  Which action should you select on the device page?

  A. Initiate Live Response Session

  B. Initiate Automated Investigation

  C. Collect investigation package

  D. Go hunt

  Correct Answer: A

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live- response?view=o365-worldwide