Microsoft Microsoft Certifications MS-102 Questions & Answers

• Question 61:

  You have a Microsoft 365 subscription.

  You configure a new Azure AD enterprise application named App1. App1 requires that a user be assigned the Reports Reader role.

  Which type of group should you use to assign the Reports Reader role and to access App1?

  A. a Microsoft 365 group that has assigned membership

  B. a Microsoft 365 group that has dynamic user membership

  C. a security group that has assigned membership

  D. a security group that has dynamic user membership

  Correct Answer: C

  To grant permissions to assignees to manage users and group access for a specific enterprise app, go to that app in Azure AD and open in the Roles and Administrators list for that app. Select the new custom role and complete the user or

  group assignment. The assignees can manage users and group access only for the specific app.

  Note: You can add the following types of groups:

  Assigned groups - Manually add users or devices into a static group.

  Dynamic groups (Requires Azure AD Premium) - Automatically add users or devices to user groups or device groups based on an expression you create.

  Note:

  Security groups

  Security groups are used for granting access to Microsoft 365 resources, such as SharePoint. They can make administration easier because you need only administer the group rather than adding users to each resource individually.

  Security groups can contain users or devices. Creating a security group for devices can be used with mobile device management services, such as Intune.

  Security groups can be configured for dynamic membership in Azure Active Directory, allowing group members or devices to be added or removed automatically based on user attributes such as department, location, or title; or device

  attributes such as operating system version.

  Security groups can be added to a team.

  Microsoft 365 Groups can't be members of security groups.

  Microsoft 365 Groups

  Microsoft 365 Groups are used for collaboration between users, both inside and outside your company. With each Microsoft 365 Group, members get a group email and shared workspace for conversations, files, and calendar events, Stream,

  and a Planner.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-enterprise-apps https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/compare-groups? https://learn.microsoft.com/en-us/mem/intune/apps/apps-deploy

• Question 62:

  Your network contains an on-premises Active Directory domain named contoso.local. The domain contains five domain controllers.

  Your company purchases Microsoft 365 and creates an Azure AD tenant named contoso.onmicrosoft.com.

  You plan to install Azure AD Connect on a member server and implement pass-through authentication.

  You need to prepare the environment for the planned implementation of pass-through authentication.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From a domain controller install an Authentication Agent

  B. From the Microsoft Entra admin center, confiqure an authentication method.

  C. From Active Director,' Domains and Trusts add a UPN suffix

  D. Modify the email address attribute for each user account.

  E. From the Microsoft Entra admin center, add a custom domain name.

  F. Modify the User logon name for each user account.

  Correct Answer: CEF

  As the local ADDS name is "contoso.local", we need to make some few steps/prerequisites before being able to set up account synchronization:

  -> Add a custom domain name on the Azure AD / MS Entra portal (ex. contoso.com)

  -> Add a local UPN suffix at the ADDS Forest level (contoso.com)

  -> Modify all user account UPN from [email protected] to [email protected]

  Then comes the Azure AD Connect deployment and the PTA configuration.

• Question 63:

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the objects shown in the following table.

  

  You configure Azure AD Connect to sync contoso.com to Azure AD. Which objects will sync to Azure AD?

  A. Group1 only

  B. User1 and User2 only

  C. Group1 and User1 only

  D. Group1, User1, and User2

  Correct Answer: D

  Disabled accounts Disabled accounts are synchronized as well to Azure AD. Disabled accounts are common to represent resources in Exchange, for example conference rooms. The exception is users with a linked mailbox; as previously mentioned, these will never provision an account to Azure AD.

  The assumption is that if a disabled user account is found, then we won't find another active account later and the object is provisioned to Azure AD with the userPrincipalName and sourceAnchor found. In case another active account will join to the same metaverse object, then its userPrincipalName and sourceAnchor will be used.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/concept-azure-ad- connect-sync-user-and-contacts

• Question 64:

  You have a Microsoft 365 E5 subscription.

  You create an account for a new security administrator named SecAdmin1.

  You need to ensure that SecAdmin1 can manage Microsoft Defender for Office 365 settings and policies for Microsoft Teams, SharePoint, and OneDrive.

  Solution: From the Microsoft Entra admin center, you assign SecAdmin1 the Security Administrator role.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  You need to assign the Security Administrator role. Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-atp

• Question 65:

  You have a Microsoft 365 E5 tenant that contains a user named User1.

  You plan to implement insider risk management.

  You need to ensure that User1 can perform the following tasks:

  Review alerts.

  Manage cases.

  Create notice templates.

  Review user emails by using Content explorer.

  The solution must use the principle of least privilege.

  To which role group should you add User1?

  A. Insider Risk Management

  B. Insider Risk Management Analysts

  C. Insider Risk Management Investigators

  D. Insider Risk Management Admin

  Correct Answer: C

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management- configure?view=o365-worldwide

• Question 66:

  You have a Microsoft 365 subscription.

  You suspect that several Microsoft Office 365 applications or services were recently updated.

  You need to identify which applications or services were recently updated.

  What are two possible ways to achieve the goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. From the Microsoft 365 admin center review the Service health blade

  B. From the Microsoft 365 admin center, review the Message center blade.

  C. From the Microsoft 365 admin center review the Products blade.

  D. From the Microsoft 365 Admin mobile agg, review the messages.

  Correct Answer: BD

  The Message center in the Microsoft 365 admin center is where you would go to view a list of the features that were recently updated in the tenant. This is where Microsoft posts official messages with information including new and changed

  features, planned maintenance, or other important announcements.

  The messages displayed in the Message center can also be viewed by using the Office 365 Admin mobile app.

  Reference:

  https://docs.microsoft.com/en-us/office365/admin/manage/message-center

  https://docs.microsoft.com/en-us/office365/admin/admin-overview/admin-mobile-app

• Question 67:

  You have a Microsoft 365 E5 subscription that contains the resources shown in the following table.

  

  You create a sensitivity label named Label1. To which resource can you apply Label1?

  A. Group1 only

  B. Group2 only

  C. Sitel only

  D. Groupl and Group2 only

  E. Group1, Group2, and Sitel

  Correct Answer: E

  Assign sensitivity labels to Microsoft 365 groups in Azure Active Directory Azure Active Directory (Azure AD), part of Microsoft Entra, supports applying sensitivity labels published by the Microsoft Purview compliance portal to Microsoft 365

  groups.

  In addition to using sensitivity labels to protect documents and emails, you can also use sensitivity labels to protect content in the following containers: Microsoft Teams sites, Microsoft 365 groups (formerly Office 365 groups), and SharePoint

  sites.

  When you configure a label policy, you can:

  Choose which users and groups see the labels. Labels can be published to any specific user or email-enabled security group, distribution group, or Microsoft 365 group (which can have dynamic membership) in Azure AD.

  Reference:

  https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams- groups-sites

  https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365- worldwide

• Question 68:

  You have a Microsoft 365 E5 subscription that has published sensitivity labels shown in the following exhibit.

  

  Which labels can users apply to content?

  A. Label1, Label2, and Label5 only

  B. Label3. Label4, and Label6 only

  C. Label1, Label3, Labe2, and Label6 only

  D. Label1, Label2, Label3, Label4, Label5. and Label6

  Correct Answer: C

• Question 69:

  You plan to use Azure Sentinel and Microsoft Cloud App Security. You need to connect Cloud App Security to Azure Sentinel.

  What should you do in the Cloud App Security admin center?

  A. From Automatic log upload, add a log collector.

  B. From Automatic log upload, add a data source.

  C. From Connected apps, add an app connector.

  D. From Security extension, add a SIEM agent.

  Correct Answer: D

• Question 70:

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the users shown in the following table.

  

  The domain syncs to an Azure AD tenant named contoso.com as shown in the exhibit. (Click the Exhibit tab.)

  

  User2 fails to authenticate to Azure AD when signing in as [email protected].

  You need to ensure that User2 can access the resources in Azure AD.

  Solution: From the Microsoft Entra admin center, you add fabrikam.com as a custom domain. You instruct User2 to sign in as [email protected].

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The on-premises Active Directory domain is named contoso.com. To enable users to sign on using a different UPN (different domain), you need to add the domain to Microsoft 365 as a custom domain.