Microsoft Microsoft Certifications MS-102 Questions & Answers

• Question 81:

  You have a Microsoft 365 E5 tenant.

  You need to create a policy that will trigger an alert when unusual Microsoft Office 365 usage patterns are detected.

  What should you use to create the policy?

  A. the Microsoft 365 admin center

  B. the Microsoft Purview compliance portal

  C. the Microsoft Defender for Cloud Apps portal

  D. the Microsoft Apps admin center

  Correct Answer: C

• Question 82:

  Your company has a Microsoft 365 E5 tenant that contains a user named User1.

  You review the company's compliance score.

  You need to assign the following improvement action to User1:Enable self-service password reset.

  What should you do first?

  A. From Compliance Manager, turn off automated testing.

  B. From the Azure Active Directory admin center, enable self-service password reset (SSPR).

  C. From the Microsoft 365 admin center, modify the self-service password reset (SSPR) settings.

  D. From the Azure Active Directory admin center, add User1 to the Compliance administrator role.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-manager- improvement-actions?view=o365-worldwide https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory- users-assign-role-azure-portal

• Question 83:

  You have a Microsoft 365 subscription.

  You have the retention policies shown in the following table.

  

  Both policies are applied to a Microsoft SharePoint site named Site1 that contains a file named File1.docx. File1.docx was created on January 1, 2022 and last modified on January 31,2022. The file was NOT modified again. When will File1.docx be deleted automatically?

  A. January 1,2023

  B. January 1,2024

  C. January 31, 2023

  D. January 31, 2024

  E. never

  Correct Answer: D

  Retention wins over deletion.

  Note:

  for the four different principles:

  1.

  Retention wins over deletion. Content won't be permanently deleted when it also has retention settings to retain it. While this principle ensures that content is preserved for compliance reasons, the delete process can still be initiated (userinitiated or system- initiated) and consequently, might remove the content from users' main view. However, permanent deletion is suspended.

  2.

  Etc. Reference:

  https://learn.microsoft.com/en-us/microsoft-365/compliance/retention

• Question 84:

  Your company has on-premises servers and an Azure AD tenant.

  Several months ago, the Azure AD Connect Hearth agent was installed on all the servers.

  You review the health status of all the servers regularly.

  Recently, you attempted to view the health status of a server named Server1 and discovered that the server is NOT listed on the Azure AD Connect Servers list.

  You suspect that another administrator removed Server1 from the list.

  You need to ensure that you can view the health status of Server1.

  What are two possible ways to achieve the goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. From Azure Cloud shell, run the Connect-Azure AD cmdlet.

  B. From Server1, change the Azure AD Connect Health Services Startup type to Automatic (Delayed Start)

  C. From Server1, change the Azure AD Connect Health Services Startup type to Automatic

  D. From Windows PowerShell, run the Rejister-ArureADConnectHealthsyncAgent cmdlet.

  E. From Server1, reinstall the Azure AD Connect Health agent

  Correct Answer: DE

• Question 85:

  You have a Microsoft 365 E5 tenant that contains 100 Windows 10 devices.

  You plan to deploy a Windows 10 Security Baseline profile that will protect secrets stored in memory. What should you configure in the profile?

  A. Microsoft Defender Credential Guard

  B. BitLocker Drive Encryption (BitLocker)

  C. Microsoft Defender

  D. Microsoft Defender Exploit Guard

  Correct Answer: A

• Question 86:

  You have a Microsoft 365 tenant.

  You plan to manage incidents in the tenant by using the Microsoft 365 security center.

  Which Microsoft service source will appear on the Incidents page of the Microsoft 365 security center?

  A. Microsoft Defender for CloudUse the

  B. Microsoft Purview

  C. Azure Arc

  D. Microsoft Defender for Identity

  Correct Answer: D

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender/investigate- alerts?view=o365-worldwide

• Question 87:

  You have a Microsoft 365 E5 subscription that contains a user named User1.

  You need to enable User1 to create Compliance Manager assessments.

  Solution: From the Microsoft 365 admin center, you assign User1 the Compliance data admin role.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference:

  https://github.com/MicrosoftDocs/microsoft-365-docs/blob/public/microsoft- 365/security/office-365-security/permissions-in-the-security-and-compliance-center.md

• Question 88:

  You have a Microsoft 365 E3 subscription that uses Microsoft Defender for Endpoint Plan 1.

  Which two Defender for Endpoint features are available to the subscription? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. advanced hunting

  B. security reports

  C. digital certificate assessment

  D. device discovery

  E. attack surface reduction (ASR)

  Correct Answer: BE

  B: Overview of Microsoft Defender for Endpoint Plan 1, Reporting The Microsoft 365 Defender portal (https://security.microsoft.com) provides easy access to information about detected threats and actions to address those threats.

  The Home page includes cards to show at a glance which users or devices are at risk, how many threats were detected, and what alerts/incidents were created. The Incidents and alerts section lists any incidents that were created as a result of

  triggered alerts. Alerts and incidents are generated as threats are detected across devices. The Action center lists remediation actions that were taken. For example, if a file is sent to quarantine, or a URL is blocked, each action is listed in the

  Action center on the History tab.

  The Reports section includes reports that show threats detected and their status.

  E: What can you expect from Microsoft Defender for Endpoint P1?

  Microsoft Defender for Endpoint P1 is focused on prevention/EPP including:

  Next-generation antimalware that is cloud-based with built-in AI that helps to stop ransomware, known and unknown malware, and other threats in their tracks. (E) Attack surface reduction capabilities that harden the device, prevent zero days,

  and offer granular control over access and behaviors on the endpoint. Device based conditional access that offers an additional layer of data protection and breach prevention and enables a Zero Trust approach.

  The below table offers a comparison of capabilities are offered in Plan 1 versus Plan 2.

  

  Incorrect:

  Not A: P2 is by far the best fit for enterprises that need an EDR solution including automated investigation and remediation tools, advanced threat prevention and threat and vulnerability management (TVM), and hunting capabilities.

  Reference:

  https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/defender- endpoint-plan-1

  https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft- defender-for-endpoint-plan-1-now-included-in-m365-e3/ba-p/3060639

• Question 89:

  Your network contains an Active Directory domain.

  You deploy an Azure AD tenant.

  Another administrator configures the domain to synchronize to Azure AD.

  You discover that 10 user accounts in an organizational unit (OU) are NOT synchronized to Azure AD. All the other user accounts synchronized successfully.

  You review Azure AD Connect Health and discover that all the user account synchronizations completed successfully.

  You need to ensure that the 10 user accounts are synchronized to Azure AD.

  Solution: You run idfix.exe and export the 10 user accounts.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The question states that "all the user account synchronizations completed successfully". If there were problems with the 10 accounts that needed fixing with idfix.exe, there would have been synchronization errors in Azure AD Connect Health.

  It is likely that the 10 user accounts are being excluded from the synchronization cycle by a filtering rule.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync- configure-filtering

• Question 90:

  You have a Microsoft 365 subscription that contains the alerts shown in the following table.

  

  Which properties of the alerts can you modify?

  A. Status only

  B. Status and Comment only

  C. Status and Severity only

  D. Status, Severity, and Comment only

  E. Status, Severity, Comment and Category

  Correct Answer: B

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/update- alert?view=o365-worldwide#limitations